Falhas do tipo CWE-460

23 resultados

Limpeza inadequada ao lançar exceção

Ocorre quando o código não libera recursos (conexões, arquivos, memória) corretamente quando uma exceção é lançada antes do ponto de limpeza previsto. O programa pode vazar recursos, deixando conexões abertas ou arquivos trancados, comprometendo a estabilidade e segurança da aplicação.

Exemplo

Um método abre uma conexão com banco de dados, realiza uma query que lança exceção, e o bloco de fechamento nunca é executado. A conexão permanece aberta, esgotando o pool de conexões e indisponibilizando a aplicação para novos acessos.

Como mitigar

Use try-finally ou try-with-resources (Java) para garantir limpeza mesmo com exceção. Em linguagens modernas, prefira gerenciadores automáticos de contexto (context managers em Python, using em C#). Teste cenários de falha explicitamente para validar se recursos são liberados.

CVE-2021-34716MEDIUMCisco Expressway Series and TelePresence Video Communication Server Remote Code Execution VulnerabilityEPSS 2.4%CVE-2022-22150HIGHA memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted EPSS 1.8%CVE-2016-9592MEDIUMopenshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation tEPSS 1.3%CVE-2017-9657—Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the centraEPSS 0.8%CVE-2019-14891MEDIUMA flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container manEPSS 0.7%CVE-2022-3301MEDIUMImproper Cleanup on Thrown Exception in ikus060/rdiffwebEPSS 0.6%CVE-2022-4744HIGHA double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_EPSS 0.5%CVE-2023-46393—gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passEPSS 0.4%CVE-2026-33481MEDIUMSyft improper temporary file cleanupEPSS 0.4%CVE-2025-30157MEDIUMEnvoy crashes when HTTP ext_proc processes local repliesEPSS 0.4%CVE-2017-15127—A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlocEPSS 0.4%CVE-2024-12289MEDIUMBoundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceEPSS 0.4%CVE-2026-40583HIGHUltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant HaltEPSS 0.4%CVE-2025-32439MEDIUMpleezer allows resource exhaustion through uncollected hook script processesEPSS 0.4%CVE-2020-14304MEDIUMA memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw EPSS 0.4%CVE-2026-61387MEDIUMIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an uncheckeEPSS 0.3%CVE-2026-48524LOWPyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)EPSS 0.3%CVE-2026-20118MEDIUMCisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service VulnerabilityEPSS 0.3%CVE-2024-0316MEDIUMImproper cleanup vulnerability in FireEye Endpoint SecurityEPSS 0.3%CVE-2024-20354MEDIUMA vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adjEPSS 0.3%