Weakness (CWE)
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
More detail
When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
How to prevent it (4 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
-
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
-
Implementation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
-
Implementation
When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
Source: MITRE CWE-404
762 results · Feed
-
Medium 5.5
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use sys…
-
Medium 5.3
PCMan FTP Server STOR Command denial of service
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as problematic. This issue affects some unknown processing of the component STOR Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit…
-
Medium 5.3
PCMan FTP Server PUT Command denial of service
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as problematic. This vulnerability affects unknown code of the component PUT Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploi…
-
Medium 5.3CVE-2024-0725 Public exploit
ProSSHD denial of service
A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public …
-
Medium 5.3CVE-2024-0723 Public exploit
freeSSHd denial of service
A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…
-
Medium 4.3
EFS Easy Chat Server HTTP GET Request denial of service
A vulnerability, which was classified as problematic, has been found in EFS Easy Chat Server 3.1. Affected by this issue is some unknown functionality of the component HTTP GET Request Handler. The manipulation of the argument USERNAME leads to denial of serv…
-
Medium 5.3
EFS Easy File Sharing FTP denial of service
A vulnerability classified as problematic was found in EFS Easy File Sharing FTP 2.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username leads to denial of service. The attack can be launched remotely. The ex…
-
Medium 5.3
Karjasoft Sami HTTP Server HTTP HEAD Rrequest denial of service
A vulnerability was found in Karjasoft Sami HTTP Server 2.0. It has been classified as problematic. Affected is an unknown function of the component HTTP HEAD Rrequest Handler. The manipulation leads to denial of service. It is possible to launch the attack r…
-
Medium 5.3
PCMan FTP Server USER Command denial of service
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as problematic. This affects an unknown part of the component USER Command Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The ex…
-
Medium 5.3
FreeFloat FTP Server SIZE Command denial of service
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component SIZE Command Handler. The manipulation leads to denial of service. The attack may be launched remotely. …
-
Medium 5.3
Ability FTP Server APPE Command denial of service
A vulnerability has been found in Ability FTP Server 2.34 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component APPE Command Handler. The manipulation leads to denial of service. The attack can be launched …
-
Medium 5.3CVE-2024-0546 Public exploit
EasyFTP LIST Command denial of service
A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exp…
-
Medium 5.3
Jasper httpdx HTTP POST Request denial of service
A vulnerability was found in Jasper httpdx up to 1.5.4 and classified as problematic. This issue affects some unknown processing of the component HTTP POST Request Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The…
-
Medium 5.3
iSharer and upRedSun File Sharing Wizard GET Request denial of service
A vulnerability has been found in iSharer and upRedSun File Sharing Wizard up to 1.5.0 and classified as problematic. This vulnerability affects unknown code of the component GET Request Handler. The manipulation leads to denial of service. The attack can be …
-
High 7.5
Uniway Router Device Reset device_reset.cgi denial of service
A vulnerability was found in Uniway Router up to 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boaform/device_reset.cgi of the component Device Reset Handler. The manipulation leads to denial of service.…
-
Medium 5.3
ACME Ultra Mini HTTPd HTTP GET Request denial of service
A vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely…
-
Medium 5.3
Sentex FTPDMIN RNFR Command denial of service
A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component RNFR Command Handler. The manipulation leads to denial of service. The attack can be launched remo…
-
Medium 5.3
Poly CCX 400/CCX 600/Trio 8800/Trio C60 HTTP Header denial of service
A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack …
-
Medium 5.3
Resource exhaustion via memory leak in tokio-boring
The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion. The set_ex_data function used by the library did not deallocate memory used by pre-existing …
-
Medium 6.8
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepow…
-
High 7.4
open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with n…
-
Unscored —CVE-2023-45802 Public exploit
Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping t…
-
Medium 6.5
XINJE XD5E-30R-E Modbus denial of service
A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to …
-
Medium 6.5
Delta Electronics DVP32ES2 PLC Password Transmission denial of service
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclos…
-
Medium 4.4
Denial of Service for Revocation of Auto Renewed Certificates
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.
-
High 7.5
Multiple vulnerabilities in Open5GS
DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to…
-
Medium 4.3CVE-2023-5324 Public exploit
eeroOS Ethernet Interface denial of service
A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local n…
-
Low 2.7
ForU CMS cms_admin.php denial of service
A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has b…
-
Medium 5.3
Salt vulnerable to denial of service
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
-
Medium 4.9
I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection wit…
-
Low 3.5
nikooo777 ckSurf Spectator List Name misc.sp SpecListMenuDead denial of service
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the compone…
-
Medium 4.3
Intergard SGS Change Password denial of service
A vulnerability has been found in Intergard SGS 8.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Change Password Handler. The manipulation leads to denial of service. The attack can be launched r…
-
Unscored —
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
High 7.5
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
High 7.5
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
-
Medium 5.3CVE-2023-3206 EPSS 19%
Chengdu VEC40G denial of service
A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial…
-
Medium 6.5
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over th…
-
Medium 5.5
VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the …
-
Low 3.5
Arborator Server project.cgi start denial of service
A vulnerability classified as problematic was found in Arborator Server. This vulnerability affects the function start of the file project.cgi. The manipulation of the argument project leads to denial of service. Continious delivery with rolling releases is u…
-
High 7.5
The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject lar…