Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-404 (不恰当的资源关闭或释放) — Vulnerability Class 377

377 vulnerabilities classified as CWE-404 (不恰当的资源关闭或释放). AI Chinese analysis included.

CWE-404 represents a critical resource management weakness where software fails to properly release or incorrectly frees allocated resources, such as memory, file handles, or network connections, before they are reused. This flaw typically leads to resource exhaustion, causing application crashes, denial of service, or system instability as available resources dwindle. Attackers often exploit this by triggering repeated allocations without corresponding releases, effectively starving the system of necessary assets. To mitigate this risk, developers must implement rigorous lifecycle management, ensuring every allocated resource has a corresponding release mechanism. This involves using structured cleanup routines, leveraging language-specific garbage collection or smart pointers, and accounting for all execution paths, including error conditions and timeouts, to guarantee resources are consistently returned to the pool for safe reuse.

MITRE CWE Description
The product does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Common Consequences (2)
Availability, OtherDoS: Resource Consumption (Other), Varies by Context
Most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, the attacker might be able to launch a denial of service attack by depleting the resource pool.
ConfidentialityRead Application Data
When a resource containing sensitive information is not correctly shutdown, it may expose the sensitive data in a subsequent allocation.
Mitigations (4)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
ImplementationIt is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
ImplementationMemory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
ImplementationWhen releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
Examples (2)
The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is …
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } }
Bad · Java
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } fil.Close(); }
Good · Java
This code attempts to open a connection to a database and catches any exceptions that may occur.
try { Connection con = DriverManager.getConnection(some_connection_string); } catch ( Exception e ) { log( e ); }
Bad · Java
CVE IDTitleCVSSSeverityPublished
CVE-2026-19746 Calix GigaSpire traceroute.cmd denial of service — GigaSpire 4.3 Medium2026-08-13
CVE-2026-19745 Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service — GigaSpire 4.3 Medium2026-08-13
CVE-2025-15687 Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service — Open5GS 4.3 Medium2026-08-12
CVE-2025-15686 Open5GS HSS Service fd_msg_sess_get denial of service — Open5GS 4.3 Medium2026-08-12
CVE-2026-19362 lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service — oidc-authorizer 5.3 Medium2026-08-09
CVE-2026-15276 pdeljanov Symphonia Metadata denial of service — Symphonia 3.3 Low2026-07-09
CVE-2026-15274 lo48576 fbxcel Node Header parser.rs denial of service — fbxcel 3.3 Low2026-07-09
CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion — socket.io 7.5 High2026-07-08
CVE-2026-14651 connorskees grass visitor denial of service — grass 3.3 Low2026-07-04
CVE-2026-14650 connorskees grass UTF-8 Character raw_to_parse_error denial of service — grass 3.3 Low2026-07-04
CVE-2026-14626 NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service — hermes-agent 4.3 Medium2026-07-04
CVE-2026-14624 omec-project amf NGSetupRequest handler.go denial of service — amf 4.3 Medium2026-07-04
CVE-2026-14623 omec-project amf NGAP Message RRCInactiveTransitionReport denial of service — amf 4.3 Medium2026-07-04
CVE-2026-14618 Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service — Open5GS 4.3 Medium2026-07-04
CVE-2026-12575 DVP80ES3 Improper Resource Shutdown or Release Vulnerability — DVP80ES3 7.5 High2026-07-01
CVE-2026-13491 78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service — xiaozhi-esp32 3.7 Low2026-06-28
CVE-2026-54280 AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect — aiohttp--2026-06-22
CVE-2026-11317 Rockwell Automation Logix 5370 and 5570 Controllers Vulnerable To Denial of Service Via CIP — CompactLogix, ControlLogix--2026-06-16
CVE-2026-45174 Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization — Idira Endpoint Privilege Manager--2026-06-11
CVE-2026-47213 BoxLite: Timeout Bypass Vulnerability — boxlite 6.5 Medium2026-06-10
CVE-2026-10775 sgl-project SGLang Cache data_hash denial of service — SGLang 3.6 Low2026-06-03
CVE-2026-10295 SourceCodester Customer Review App review_app.py get_all_reviews denial of service — Customer Review App 3.3 Low2026-06-01
CVE-2026-10190 Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service — W12 6.5 Medium2026-05-31
CVE-2026-10117 Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service — Open5GS 4.3 Medium2026-05-30
CVE-2026-10116 Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service — Open5GS 4.3 Medium2026-05-30
CVE-2026-10115 Open5GS Shared NF-profile nnrf-handler.c denial of service — Open5GS 4.3 Medium2026-05-30
CVE-2026-10113 Open5GS Shared NF-profile nnrf-handler.c denial of service — Open5GS 4.3 Medium2026-05-30
CVE-2026-9540 vllm-project vllm OpenAI-compatible Serving Path denial of service — vllm 5.3 Medium2026-05-26
CVE-2026-8745 Open5GS AUSF nausf-handler.c ogs_timer_add denial of service — Open5GS 4.3 Medium2026-05-17
CVE-2026-8744 Open5GS NRF context.c ogs_sbi_nf_service_add denial of service — Open5GS 4.3 Medium2026-05-17

Vulnerabilities classified as CWE-404 (不恰当的资源关闭或释放) represent 377 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.