Weakness (CWE)
CWE-460: Improper Cleanup on Thrown Exception
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown.
How to prevent it (1 mitigation)
-
Implementation
If one breaks from a loop or function by throwing an exception, make sure that cleanup happens or that you should exit the program. Use throwing exceptions sparsely.
Source: MITRE CWE-460
9 results · Clear filters · Feed
-
High 8.7
Improper cleanup on thrown exception in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) …
-
High 7.5
Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart…
-
High 8.2
HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream erro…
-
High 7.5
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exce…
-
High 8.8
UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
-
High 7.5
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOf…
-
High 8.7
tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This a…
-
High 7.8
A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the devi…
-
High 8.8
A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543.…