Falhas do tipo CWE-459

86 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2025-31650HIGHApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameEPSS 59.9%CVE-2022-1552—A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another usEPSS 12.5%CVE-2022-21125MEDIUMIncomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable infoEPSS 6.5%CVE-2023-41835HIGHApache Struts: excessive disk usageEPSS 6.3%CVE-2022-21123MEDIUMIncomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable informatiEPSS 6.2%CVE-2022-21166MEDIUMIncomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentiallyEPSS 5.8%CVE-2022-21127MEDIUMIncomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially EPSS 5.5%CVE-2022-1473HIGHResource leakage when decoding certificates and keysEPSS 2.5%CVE-2024-23672MEDIUMApache Tomcat: WebSocket DoS with incomplete closing handshakeEPSS 2.3%CVE-2023-42795MEDIUMApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsEPSS 2.2%CVE-2023-42794—Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsEPSS 1.9%CVE-2023-36468CRITICALUpgrading doesn't prevent exploiting vulnerable XWiki documentsEPSS 1.8%CVE-2025-64775HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS)EPSS 1.5%CVE-2022-45347CRITICALApache ShardingSphere-Proxy: MySQL authentication bypassEPSS 1.4%CVE-2021-32928—The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows iEPSS 1.3%CVE-2023-0836HIGHAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.EPSS 1.2%CVE-2020-12494MEDIUMBeckhoff: Etherleak in TwinCAT RT network driverEPSS 1.0%CVE-2021-36205HIGHMetasys session tokenEPSS 1.0%CVE-2025-2260HIGHEclipse ThreadX NetX Duo HTTP component server denial of serviceEPSS 0.9%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.7%