CWE-226 Sensitive Information in Resource Not Removed Before Reuse
baseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (52)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25762US | high8.6 | — | ||
If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20,… | ||||
| CVE-2022-39393US | high8.6 | — | ||
Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a line… | ||||
| CVE-2018-7166US | high7.5 | — | ||
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only re… | ||||
| CVE-2016-0879US | high7.5 | — | ||
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain… | ||||
| CVE-2025-13108US | high7.5 | — | ||
IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources. | ||||
| CVE-2024-49997US | high7.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: lantiq_etop: fix memory disclosure
When applying padding, the buffer is not zeroed, which resul… | ||||
| CVE-2023-41138US | medium6.7 | — | ||
The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process. | ||||
| CVE-2024-32036US | medium6.5 | — | ||
ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JP… | ||||
| CVE-2018-12207US | medium6.5 | — | ||
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of se… | ||||
| CVE-2019-25571US | medium5.5 | — | ||
MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively… | ||||
| CVE-2019-25563US | medium5.5 | — | ||
PCHelpWareV2 1.0.0.5 contains a denial of service vulnerability that allows local attackers to crash the application by supplying a malformed image file. Attackers can trigger the… | ||||
| CVE-2019-25553US | medium5.5 | — | ||
CEWE PHOTO IMPORTER 6.4.3 contains a denial of service vulnerability that allows local attackers to crash the application by importing a specially crafted image file. Attackers can… | ||||
| CVE-2025-33196US | medium5.5 | — | ||
NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to in… | ||||
| CVE-2025-48066US | medium5.5 | — | ||
wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the cl… | ||||
| CVE-2024-53212US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
netlink: fix false positive warning in extack during dumps
Commit under fixes extended extack reporting to dum… | ||||
| CVE-2023-3006US | medium5.5 | — | ||
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2… | ||||
| CVE-2023-1637US | medium5.5 | — | ||
A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the… | ||||
| CVE-2022-23824US | medium5.5 | — | ||
IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. | ||||
| CVE-2020-27218US | medium4.8 | — | ||
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests fro… | ||||
| CVE-2026-114501US | medium5.3 | — | ||
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_A… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan