Weakness (CWE)
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Source: MITRE CWE-459
164 results · Feed
-
High 7.5
Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving reje…
-
Low 3.1
nvm install --offline installs a cached tarball that previously failed checksum verification
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its chec…
-
High 8.8
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin p…
-
Unscored —
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system acces…
-
Unscored —
Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local pr…
-
Medium 4.6
Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer
The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and the BT_AVRCP_TG_FLAG_…
-
High 7.1
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads a…
-
High 7.1
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `me…
-
High 8.8
Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
Medium 6.5
Incomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the ren…
-
Medium 6.5
Incomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised …
-
High 8.8
Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin po…
-
High 8.8
Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the ren…
-
High 7.5
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged fil…
-
High 7.5
Apache Tomcat: Possible TLS 1.3 connection failures
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to up…
-
High 7.5
Apache Tomcat: HTTP/2 trailer header cross-contamination
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.…
-
Medium 4.2
@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback w…
-
Medium 5.1
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph ent…
-
High 7.5
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…
-
Medium 5.2
My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
-
High 7.5
Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocols mvpn inter-region-…
-
High 8.7
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and deny service regardle…
-
Medium 5.1
Code for IBM i: Temporary files are visible to all users
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory withou…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary …
-
High 7.2
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate t…
-
Medium 6.5
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reach…
-
Medium 6.5
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notifi…
-
High 7.8
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when deliveri…
-
Medium 5.5
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to ve…
-
Critical 9.1
Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass …
-
Medium 4.3
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineer…
-
Medium 4.2
Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromise…
-
Critical 9.6
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arb…
-
High 8.8
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging s…
-
Medium 5.3
Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensiti…
-
Medium 5.4
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to byp…
-
Medium 5.9
Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical …
-
Medium 5.3
Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header h…
-
High 8.4
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social eng…
-
Medium 6.5
Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social eng…