Skip to content
OpenAdvisories

Weakness (CWE)

CWE-404: Improper Resource Shutdown or Release

Class Draft

The product does not release or incorrectly releases a resource before it is made available for re-use.

More detail

When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

How to prevent it (4 mitigations)

  1. Requirements

    Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.

  2. Implementation

    It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.

  3. Implementation

    Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

  4. Implementation

    When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.

Source: MITRE CWE-404

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-78250 Public exploit

    bytebot-ai bytebot Agent Execution Workflow infinite loop

    A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly avail…

    bytebot-ai bytebot
  • Medium 5.5
    CVE-2026-38763 Public exploit

    An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via th…

  • Medium 6.5
    CVE-2024-12342 Public exploit

    TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service

    A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/WANIPConnection of the component Incomplete SOAP Request Handler. The manipulation leads to denial o…

    TP-Link VN020 F3v(T) Network devices
  • Medium 5.5
    CVE-2024-12227 Public exploit

    MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference

    A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLib_X64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. I…

    MSI Dragon Center
  • Medium 5.3
    CVE-2024-0737 Public exploit

    Xlightftpd Xlight FTP Server Login denial of service

    A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Login. The manipulation of the argument user leads to denial of service. The attack can be initiated remotely. Th…

    Xlightftpd Xlight FTP Server
  • Medium 5.3
    CVE-2024-0725 Public exploit

    ProSSHD denial of service

    A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public …

  • Medium 5.3
    CVE-2024-0723 Public exploit

    freeSSHd denial of service

    A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…

  • Medium 5.3
    CVE-2024-0546 Public exploit

    EasyFTP LIST Command denial of service

    A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exp…

  • Medium 4.3
    CVE-2023-5324 Public exploit

    eeroOS Ethernet Interface denial of service

    A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local n…

  • Medium 6.5
    CVE-2022-44267 Public exploit EPSS 77%

    ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert pro…

    imagemagick imagemagick imagemagick Debian Ubuntu Alpine