Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CWE-404 (不恰当的资源关闭或释放) — Vulnerability Class 411

411 vulnerabilities classified as CWE-404 (不恰当的资源关闭或释放). AI Chinese analysis included.

CWE-404 represents a critical resource management weakness where software fails to properly release or incorrectly frees allocated resources, such as memory, file handles, or network connections, before they are reused. This flaw typically leads to resource exhaustion, causing application crashes, denial of service, or system instability as available resources dwindle. Attackers often exploit this by triggering repeated allocations without corresponding releases, effectively starving the system of necessary assets. To mitigate this risk, developers must implement rigorous lifecycle management, ensuring every allocated resource has a corresponding release mechanism. This involves using structured cleanup routines, leveraging language-specific garbage collection or smart pointers, and accounting for all execution paths, including error conditions and timeouts, to guarantee resources are consistently returned to the pool for safe reuse.

MITRE CWE Description
The product does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Common Consequences (2)
Availability, Other DoS: Resource Consumption (Other), Varies by Context
Most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, the attacker might be able to launch a denial of service attack by depleting the resource pool.
Confidentiality Read Application Data
When a resource containing sensitive information is not correctly shutdown, it may expose the sensitive data in a subsequent allocation.
Mitigations (4)
Requirements Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
Implementation It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
Implementation Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
Implementation When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
Examples (2)
The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is …
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } }
Bad · Java
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } fil.Close(); }
Good · Java
This code attempts to open a connection to a database and catches any exceptions that may occur.
try { Connection con = DriverManager.getConnection(some_connection_string); } catch ( Exception e ) { log( e ); }
Bad · Java
CVE ID Title CVSS Severity Published
CVE-2026-122020 NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service — Nstbrowser 4.3 Medium 2026-11-04
CVE-2026-117504 a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service — a2a-go 5.3 Medium 2026-10-27
CVE-2026-115971 Travisun Opptrix preParsing handler webhook Buffer.concat denial of service — Opptrix 5.3 Medium 2026-10-24
CVE-2026-112083 sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service — SGLang 5.3 Medium 2026-10-19
CVE-2026-112082 sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service — SGLang 7.5 High 2026-10-19
CVE-2026-110809 sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service — SGLang 4.3 Medium 2026-10-14
CVE-2026-110807 sgl-project SGLang generate Endpoint io_struct.py denial of service — SGLang 4.3 Medium 2026-10-14
CVE-2026-49785 UEFI Secure Boot Security Feature Bypass Vulnerability — Windows 10 Version 1607 7.8 High 2026-10-13
CVE-2026-109277 ImageMagick before 7.1.2-32 Policy Bypass via -script Operation — ImageMagick 3.3 Low 2026-10-12
CVE-2026-108769 zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service — CowAgent 4.3 Medium 2026-10-11
CVE-2026-108682 zhayujie CowAgent Web Console upload read denial of service — CowAgent 5.4 Medium 2026-10-11
CVE-2026-108681 zhayujie CowAgent Web Console web_channel.py denial of service — CowAgent 4.3 Medium 2026-10-11
CVE-2026-105922 vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service — vLLM 4.3 Medium 2026-10-06
CVE-2026-103241 vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service — vLLM 5.3 Medium 2026-09-30
CVE-2026-47491 NVIDIA Linux驱动内核内存释放不当致代码执行漏洞 — GeForce 7.8 High 2026-09-30
CVE-2026-101040 Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service — SP 330DN 6.5 Medium 2026-09-28
CVE-2026-94137 Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service — shzh 3.3 Low 2026-09-21
CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service — OpenClaw 4.3 Medium 2026-09-20
CVE-2026-91855 Open5GS PFCP Message handler.c denial of service — Open5GS 5.3 Medium 2026-09-15
CVE-2026-90816 FFmpeg Duration hlsproto.c parse_playlist denial of service — FFmpeg 4.3 Medium 2026-09-14
CVE-2026-90713 vllm-project vLLM tiktoken vocab File mod.rs new denial of service — vLLM 3.3 Low 2026-09-14
CVE-2026-90712 Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service — openclaude 4.3 Medium 2026-09-14
CVE-2026-85407 Eleveo Quality Management Conversation events denial of service — Quality Management 4.3 Medium 2026-09-04
CVE-2026-84887 simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service — Agent-S 4.3 Medium 2026-09-02
CVE-2026-84885 simular-ai Agent-S CodeAgent code_agent.py denial of service — Agent-S 4.3 Medium 2026-09-02
CVE-2026-84856 rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service — rowboat 5.3 Medium 2026-09-02
CVE-2026-84427 zhayujie CowAgent Bash Tool bash.py denial of service — CowAgent 4.3 Medium 2026-09-02
CVE-2026-84425 zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service — CowAgent 4.3 Medium 2026-09-02
CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service — hermes-agent 4.3 Medium 2026-09-01
CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service — hermes-agent 4.3 Medium 2026-09-01

Vulnerabilities classified as CWE-404 (不恰当的资源关闭或释放) represent 411 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.