Weakness (CWE)
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
More detail
When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
How to prevent it (4 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
-
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
-
Implementation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
-
Implementation
When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
Source: MITRE CWE-404
101 results · Clear filters · Feed
-
High 7.5
D-Link DIR-823X FUN_00412244 null pointer dereference
A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has b…
-
High 7.5
An issue in the HEAP_malloc component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) vi…
-
High 7.5
An issue in the bind_col_exp component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) …
-
High 7.5
An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial …
-
High 7.5
An issue in the sqlg_parallel_ts_seq component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Deni…
-
High 7.5
An issue in the sqlo_df component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service…
-
High 7.8
Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregist…
-
High 7.5
In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via…
-
High 7.5CVE-2024-51179 Public exploit
An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizat…
-
High 7.5
-
High 7.5
An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until comp…
-
High 7.5
A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a …
-
High 7.5
RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker ca…
-
High 7.5
Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service
A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects unknown code of the component Application Protocol Data Unit. The manipulation leads to denial of service. The attack ca…
-
High 7.5
The 'control' in Parrot ANAFI USA firmware 1.10.4 does not check the MAV_MISSION_TYPE(0, 1, 2, 255), which allows attac…
-
High 7.5
Possible denial of service vulnerability with Content-length header in Traefik
Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited b…
-
High 7.5
CoreWCF NetFraming based services can leave connections open when they should be closed
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. T…
-
High 7.5
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…
-
High 7.5
Uniway Router Device Reset device_reset.cgi denial of service
A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service.…
-
High 7.4
open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with n…
-
High 7.5
Multiple vulnerabilities in Open5GS
DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to…
-
High 7.5
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
High 7.5
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
High 7.5
The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject lar…
-
High 7.5
Ubiquiti EdgeRouter X Web Service denial of service
A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The ex…
-
High 7.5
SDM600 endpoint vulnerability
A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive. This issue affects: All SDM600 versions prior to versi…
-
High 7.5
Filseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of service
A vulnerability was found in Filseclab Twister Antivirus 8. It has been rated as critical. This issue affects the function 0x8011206B in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack may…
-
High 7.5
Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series
Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prio…
-
High 7.5
The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect s…
-
High 8.2
Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttlin…
-
High 7.5
The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may …
-
High 7.5
A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
-
High 7.5
BIG-IP HTTP MRF vulnerability CVE-2022-35272
In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a…
-
High 7.5
BIG-IP Message Routing MQTT vulnerability CVE-2022-35240
In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memo…
-
High 7.5CVE-2022-2591 Public exploit
TEM FLEX-1085 reboot denial of service
A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been di…
-
High 7.5
Jetty SslConnection does not release pooled ByteBuffers in case of errors
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
-
High 8.6
Response mix-up with WebSocket concurrent send and close
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it h…
-
High 7.5
Resource leakage when decoding certificates and keys
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cer…
-
High 8.0
Information Exposure when using Puma with Rails
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …
-
High 7.5
Improper Resource Shutdown or Release in TYPO3 extension
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.