Weaknesses of type CWE-226

33 results

Informação sensível não removida antes de reutilizar recurso

Ocorre quando dados sensíveis (senhas, tokens, chaves, PII) permanecem em memória, disco ou outro recurso após seu uso e esse recurso é reutilizado ou alocado a outro contexto. Um atacante com acesso a esse recurso consegue recuperar a informação confidencial que deveria ter sido apagada.

Example

Uma aplicação aloca um buffer para processar um arquivo de configuração contendo senha de banco de dados, mas ao terminar reutiliza esse mesmo buffer sem limpá-lo. Se o buffer for posteriormente alocado a outro usuário ou processo, a senha anterior fica acessível.

How to mitigate

Sempre sobrescrever memória contendo dados sensíveis com zeros ou padrões aleatórios imediatamente após o uso, antes de liberar o recurso. Use funções específicas para limpeza segura (como `memset_s` em C, ou mecanismos de linguagem que garantem zeroing) e implemente auditoria de alocação de recursos críticos.

CVE-2020-27218—In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request boEPSS 8.1%CVE-2018-7166—In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This mEPSS 3.2%CVE-2022-39393HIGHWasmtime vulnerable to data leakage between instances in the pooling allocatorEPSS 0.7%CVE-2024-32036MEDIUMSixLabors.ImageSharp vulnerable to data leakageEPSS 0.6%CVE-2026-5795HIGHIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning froEPSS 0.5%CVE-2019-25560HIGHLyric Video Creator 2.1 Denial of Service via MP3 FileEPSS 0.5%CVE-2024-7883LOWCMSE secure state may leak from stack to floating-point registersEPSS 0.5%CVE-2026-47247HIGHlibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane AllocationEPSS 0.4%CVE-2024-38275HIGHmoodle: HTTP authorization header is preserved between "emulated redirects"EPSS 0.4%CVE-2026-13585HIGHAllocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContEPSS 0.3%CVE-2025-11602MEDIUMUntargeted information leak in Bolt protocol handshakeEPSS 0.3%CVE-2019-1573LOWInformation Disclosure in GlobalProtect AgentEPSS 0.3%CVE-2023-3006MEDIUMA known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOEPSS 0.3%CVE-2026-32960HIGHSD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuEPSS 0.3%CVE-2025-2522MEDIUMLack of buffer clearing before reuse may result in incorrect system behavior.EPSS 0.2%CVE-2023-1637MEDIUMA flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power managementEPSS 0.2%CVE-2024-21850HIGHSensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow aEPSS 0.2%CVE-2019-25657MEDIUMAnyBurn 4.3 x86 Denial of Service via Image ConversionEPSS 0.2%CVE-2025-13108MEDIUMFixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and WindowsEPSS 0.2%CVE-2019-25563MEDIUMPCHelpWareV2 1.0.0.5 Denial of Service via SC CreationEPSS 0.2%