目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1359 元

100%

CWE-404 不恰当的资源关闭或释放 类漏洞列表 411

CWE-404 不恰当的资源关闭或释放 类弱点 411 条 CVE 漏洞汇总,含 AI 中文分析。

CWE-404属于资源管理缺陷,指程序在资源重用前未正确释放或释放不当。攻击者常利用此漏洞耗尽系统资源,导致拒绝服务或引发内存泄漏。开发者需确保在所有执行路径(包括异常和超时)中均正确释放资源,严格管理资源生命周期,防止资源泄露以维持系统稳定性。

MITRE CWE 官方描述
CWE:CWE-404 不正确的资源关闭或释放 (Improper Resource Shutdown or Release) 英文:产品在资源被重新使用前未释放或不正确地释放了资源。 当资源被创建或分配时,开发人员有责任正确释放该资源,并考虑到所有潜在的过期或失效路径,例如设定的时间段或撤销。
常见影响 (2)
Availability, Other DoS: Resource Consumption (Other), Varies by Context
Most unreleased resource issues result in general software reliability problems, but if an attacker can intentionally trigger a resource leak, the attacker might be able to launch a denial of service attack by depleting the resource pool.
Confidentiality Read Application Data
When a resource containing sensitive information is not correctly shutdown, it may expose the sensitive data in a subsequent allocation.
缓解措施 (4)
Requirements Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
Implementation It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
Implementation Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
Implementation When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
代码示例 (2)
The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is …
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } }
Bad · Java
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } fil.Close(); }
Good · Java
This code attempts to open a connection to a database and catches any exceptions that may occur.
try { Connection con = DriverManager.getConnection(some_connection_string); } catch ( Exception e ) { log( e ); }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-15229 Tenda CH22 安全漏洞 — CH22 5.3 Medium 2025-12-30
CVE-2025-14747 Ningyuanda TC155 安全漏洞 — TC155 4.3 Medium 2025-12-16
CVE-2025-14105 TOZED ZLT M30S和TOZED ZLT M30S PRO 安全漏洞 — ZLT M30S 4.3 Medium 2025-12-05
CVE-2025-13564 SourceCodester Pre-School Management System 安全漏洞 — Pre-School Management System 5.4 Medium 2025-11-23
CVE-2025-13524 Amazon Web Services Wickr 安全漏洞 — Wickr 5.7 Medium 2025-11-21
CVE-2025-12917 TOZED ZLT T10 安全漏洞 — ZLT T10 4.3 Medium 2025-11-09
CVE-2025-36006 IBM Db2 安全漏洞 — Db2 6.5 Medium 2025-11-07
CVE-2025-61795 Apache Tomcat 安全漏洞 — Apache Tomcat 7.5 - 2025-10-27
CVE-2025-47148 F5 BIG-IP 安全漏洞 — BIG-IP 6.5 Medium 2025-10-15
CVE-2025-11642 Tomofun Furbo 360和Tomofun Furbo Mini 安全漏洞 — Furbo 360 4.0 Medium 2025-10-12
CVE-2025-11638 Tomofun Furbo 360和Tomofun Furbo Mini 安全漏洞 — Furbo 360 4.3 Medium 2025-10-12
CVE-2025-57882 AutomationDirect CLICK PLUS 安全漏洞 — CLICK PLUS C0-0x CPU firmware 5.9 Medium 2025-09-23
CVE-2025-58473 AutomationDirect CLICK PLUS 安全漏洞 — CLICK PLUS C0-0x CPU firmware 5.9 Medium 2025-09-23
CVE-2025-10475 SpyShelter 安全漏洞 — SpyShelter 5.5 Medium 2025-09-15
CVE-2025-20127 Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 7.7 High 2025-08-14
CVE-2025-48989 Apache Tomcat 安全漏洞 — Apache Tomcat 7.5AI High AI 2025-08-13
CVE-2025-8761 INSTAR 2K+和INSTAR 4K 安全漏洞 — 2K+ 7.5 High 2025-08-13
CVE-2025-8805 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-8803 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-8802 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-8801 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-8800 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-8799 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2025-08-10
CVE-2025-52982 Juniper Networks Junos OS 安全漏洞 — Junos OS 5.9 Medium 2025-07-11
CVE-2025-49483 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01
CVE-2025-49482 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01
CVE-2025-49481 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01
CVE-2025-49488 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01
CVE-2025-49491 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01
CVE-2025-49490 Asrmicro ASR Series 安全漏洞 — Falcon_Linux、Kestrel、Lapwing_Linux 5.4 Medium 2025-07-01

CWE-404(不恰当的资源关闭或释放) 是常见的弱点类别,本平台收录该类弱点关联的 411 条 CVE 漏洞。