Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-772 (对已超过有效生命周期的资源丧失索引) — Vulnerability Class 65

65 vulnerabilities classified as CWE-772 (对已超过有效生命周期的资源丧失索引). AI Chinese analysis included.

CWE-772 represents a resource management weakness where software fails to release allocated resources, such as memory, file handles, or network connections, after they are no longer needed. This oversight typically leads to resource exhaustion, causing system instability, performance degradation, or denial-of-service conditions as available resources dwindle. Attackers often exploit this by triggering repeated allocations without corresponding releases, effectively starving the system of critical resources. To prevent this, developers must implement strict lifecycle management protocols, ensuring that every allocated resource is explicitly freed or closed once its operational purpose concludes. Utilizing automated memory management tools, adhering to the RAII paradigm, and conducting rigorous code reviews for proper cleanup routines are essential strategies for mitigating this vulnerability and maintaining system reliability.

MITRE CWE Description
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Common Consequences (1)
AvailabilityDoS: Resource Consumption (Other), DoS: Resource Consumption (Memory), DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Mitigations (3)
RequirementsUse a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
ImplementationIt is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including error conditions.
Operation, Architecture and DesignUse resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems. When the current levels get close to the maximum that is define…
Examples (2)
The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is …
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } }
Bad · Java
private void processFile(string fName) { BufferReader fil = new BufferReader(new FileReader(fName)); String line; while ((line = fil.ReadLine()) != null) { processLine(line); } fil.Close(); }
Good · Java
The following code attempts to open a new connection to a database, process the results returned by the database, and close the allocated SqlConnection object.
SqlConnection conn = new SqlConnection(connString); SqlCommand cmd = new SqlCommand(queryString); cmd.Connection = conn; conn.Open(); SqlDataReader rdr = cmd.ExecuteReader(); HarvestResults(rdr); conn.Connection.Close();
Bad · C#
CVE IDTitleCVSSSeverityPublished
CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization — BC-FJA 8.7 High2026-08-08
CVE-2026-20124 Cisco IOS XE Software SNMP Denial of Service Vulnerability — Cisco IOS XE Software 7.7 High2026-08-05
CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS — Apache HttpComponents Client--2026-07-31
CVE-2026-12353 Rhcs: memory leak during https connection leads to denial of service — Red Hat Certificate System 9 5.3 Medium2026-07-23
CVE-2026-56444 Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration — Unbound 5.9 Medium2026-07-22
CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries — Unbound 3.7 Low2026-07-22
CVE-2026-15713 Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak — Red Hat Enterprise Linux 10 5.9 Medium2026-07-14
CVE-2026-54786 Wasmtime: Leak in WASIp1 `fd_renumber` implementation — wasmtime--2026-07-01
CVE-2026-13351 net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets — Zephyr 7.5 High2026-06-25
CVE-2026-45287 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse — go.opentelemetry.io/otel/schema/v1.1--2026-06-04
CVE-2026-9156 Tanium addressed a denial of service vulnerability in Tanium Server. — Tanium Server 6.5 Medium2026-05-27
CVE-2026-42577 Netty: epoll transport denial of service via RST on half-closed TCP connection — netty 7.5 High2026-05-13
CVE-2026-39455 BIG-IP Configuration utility vulnerability — BIG-IP 7.5 High2026-05-13
CVE-2026-35227 Improper resource management in CODESYS Modbus TCP Server — CODESYS Modbus--2026-05-12
CVE-2026-3104 Memory leak in code preparing DNSSEC proofs of non-existence — BIND 9 7.5 High2026-03-25
CVE-2026-2261 blocklistd(8) socket leak — FreeBSD 7.5AIHighAI2026-03-09
CVE-2026-20082 Cisco Secure Firewall Adaptive Security Appliance 安全漏洞 — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 8.6 High2026-03-04
CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion — multer 7.5 -2026-02-27
CVE-2025-14969 Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect — Red Hat build of Quarkus 3.27.2 4.3 Medium2026-01-26
CVE-2026-21874 NiceGUI has Redis connection leak via tab storage causes service degradation — nicegui 5.3 Medium2026-01-08
CVE-2025-64734 Gallagher T-Series Reader 安全漏洞 — T21 Reader 2.4 Low2025-11-18
CVE-2025-54983 Health check port on ZCC allows tunnel bypass — Zscaler Client Connector 5.2 Medium2025-11-12
CVE-2025-62723 FlashMQ does not release memory of queued QoS messages — FlashMQ 4.3 Medium2025-10-24
CVE-2025-36128 IBM MQ denial of service — MQ 7.5 High2025-10-16
CVE-2025-61670 Wasmtime has memory leak in C API with `externref` and `anyref` types — wasmtime 7.5AIHighAI2025-10-07
CVE-2025-30256 Tenda AC6 安全漏洞 — AC6 V5.0 8.6 High2025-08-20
CVE-2023-32255 Kernel: memory leak via ksmbd session setup request with unknown ntlmssp message type 5.3 Medium2025-08-02
CVE-2025-36071 IBM Db2 denial of service — IBM Db2 6.5 Medium2025-07-29
CVE-2025-44003 Gallagher T-Series Reader 安全漏洞 — T-Series Readers 4.3 Medium2025-07-10
CVE-2025-3864 Connection pool exhaustion in hackney — hackney 4.3AIMediumAI2025-05-28

Vulnerabilities classified as CWE-772 (对已超过有效生命周期的资源丧失索引) represent 65 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.