Falhas do tipo CWE-459

115 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2022-45455MEDIUMLocal privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office EPSS 0.1%CVE-2026-75944MEDIUMA race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserEPSS 0.1%CVE-2026-35361LOWuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux SystemsEPSS 0.1%CVE-2026-75943LOWA brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemEPSS 0.1%CVE-2026-75945LOWA race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.EPSS 0.1%CVE-2026-28196LOWIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskEPSS 0.1%CVE-2026-72714MEDIUMRocq Prover through 9.2.0 Universe Checking State Desynchronised After Module CloseEPSS 0.1%CVE-2026-20712MEDIUMIncomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System softwEPSS 0.1%CVE-2026-6830MEDIUMNesquena Hermes WebUI Environment Variable Credential Leakage via Profile SwitchEPSS 0.1%CVE-2026-0427MEDIUMImproper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to EPSS 0.1%CVE-2024-45445MEDIUMVulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will afEPSS 0.1%CVE-2025-29934MEDIUMA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiEPSS 0.1%CVE-2026-19730MEDIUMPodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesEPSS 0.1%CVE-2023-20518LOWIncomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shellEPSS 0.1%CVE-2026-78437—Apache Tomcat: HTTP/2 DoS via malformed requestEPSS —