Falhas do tipo CWE-459

158 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2026-121096—Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium secuEPSS 0.2%CVE-2022-45455MEDIUMLocal privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office EPSS 0.1%CVE-2026-28196LOWIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskEPSS 0.1%CVE-2026-121750LOWnvm install --offline installs a cached tarball that previously failed checksum verificationEPSS 0.1%CVE-2026-17525MEDIUMMy Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversionEPSS 0.1%CVE-2026-35361LOWuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux SystemsEPSS 0.1%CVE-2026-19730MEDIUMPodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesEPSS 0.1%CVE-2026-107914HIGHBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archiEPSS 0.1%CVE-2025-29934MEDIUMA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiEPSS 0.1%CVE-2026-6830MEDIUMNesquena Hermes WebUI Environment Variable Credential Leakage via Profile SwitchEPSS 0.1%CVE-2026-0427MEDIUMImproper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to EPSS 0.1%CVE-2024-45445MEDIUMVulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will afEPSS 0.1%CVE-2026-106243MEDIUMIncomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crEPSS 0.1%CVE-2026-107332MEDIUMInsecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio CodeEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%CVE-2026-19739MEDIUMBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateEPSS 0.1%CVE-2026-110008MEDIUM@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callbackEPSS 0.1%CVE-2023-20518LOWIncomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shellEPSS 0.1%