Skip to content
OpenAdvisories

Weakness (CWE)

CWE-404: Improper Resource Shutdown or Release

Class Draft

The product does not release or incorrectly releases a resource before it is made available for re-use.

More detail

When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

How to prevent it (4 mitigations)

  1. Requirements

    Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.

  2. Implementation

    It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.

  3. Implementation

    Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

  4. Implementation

    When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.

Source: MITRE CWE-404

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.5
    CVE-2026-113872 Public exploit

    multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

    multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while o…

    multer multer multer node-multer Debian npm
  • High 7.8
    CVE-2026-53365 Public exploit

    vsock/virtio: fix zerocopy completion for multi-skb sends

    In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.4
    CVE-2025-69821 Public exploit

    An issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service…

  • High 7.5
    CVE-2025-63895 Public exploit

    An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause …

  • High 7.1
    CVE-2025-6202 Public exploit

    Phoenix: Rowhammer attack on Hynix DDR5 devices

    Vulnerability in SK Hynix DDR5 on x86 allows a local attacker to trigger Rowhammer bit flips impacting the Hardware Integrity and the system's security. This issue affects DDR5: DIMMs produced from 2021-1 until 2024-12.

    SK Hynix DDR5
  • High 7.5
    CVE-2025-9784 Public exploit

    Undertow: undertow madeyoureset http/2 ddos vulnerability

    A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeate…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Maven
  • High 7.5
    CVE-2025-8671 Public exploit

    CVE-2025-8671

    A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening stre…

    varnish-software Fastly SUSE Linux Wind River Linux Debian Ubuntu Alpine crates.io
  • High 7.5
    CVE-2024-51179 Public exploit

    An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizat…

  • High 7.5
    CVE-2022-2591 Public exploit

    TEM FLEX-1085 reboot denial of service

    A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been di…

    TEM FLEX-1085
  • High 8.4
    CVE-2018-8639 Exploited · Ransomware Public exploit EPSS 22%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows
    KEV Mar 3, 2025
  • High 7.8
    CVE-2018-8611 Exploited Public exploit

    An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka …

    Microsoft Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows
    KEV May 24, 2022
  • High 7.0
    CVE-2018-8120 Exploited · Ransomware Public exploit EPSS 73%

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…

    Microsoft Windows 7 Windows Server 2008 R2 Windows Server 2008 Windows
    KEV Mar 15, 2022