CWE-404— Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.— MITRE CWE catalog

895 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-404page 8 of 18

CVE-2021-28715MEDIUMCVSS 6.5EG 6.5
2022-01-06
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest i…
CVE-2021-28714MEDIUMCVSS 6.5EG 6.5
2022-01-06
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest i…
CVE-2020-21839MEDIUMCVSS 6.5EG 6.5
2021-05-17
An issue was discovered in GNU LibreDWG 0.10. Crafted input will lead to an memory leak in dwg_decode_eed ../../src/decode.c:3638.
CVE-2020-0414MEDIUMCVSS 6.5EG 6.5
2020-10-14
In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions bypass. This could lead to remote information disclosure with no additional execution privileges need…
CVE-2020-5416MEDIUMCVSS 6.5EG 6.5
2020-08-21
Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attac…
CVE-2020-14307MEDIUMCVSS 6.5EG 6.5
2020-07-24
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, …
CVE-2020-4325MEDIUMCVSS 6.5EG 6.5
2020-04-02
The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a …
CVE-2019-15302MEDIUMCVSS 6.5EG 6.5
2019-09-11
The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.
CVE-2023-0417MEDIUMCVSS 6.3EG 6.5
2023-01-26
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVE-2023-0416MEDIUMCVSS 6.3EG 6.5
2023-01-26
GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVE-2023-0415MEDIUMCVSS 6.3EG 6.5
2023-01-26
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVE-2023-0414MEDIUMCVSS 6.3EG 6.5
2023-01-26
Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file
CVE-2023-0413MEDIUMCVSS 6.3EG 6.5
2023-01-26
Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVE-2023-0412MEDIUMCVSS 6.3EG 6.5
2023-01-26
TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
CVE-2024-23930MEDIUMCVSS 4.3EG 6.5
2025-01-31
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exist…
CVE-2021-4280MEDIUMCVSS 4.3EG 6.5
2022-12-25
A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is p…
CVE-2022-3957MEDIUMCVSS 4.3EG 6.5
2022-11-11
A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory…
CVE-2022-3810MEDIUMCVSS 4.3EG 6.5
2022-11-02
A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possi…
CVE-2022-3809MEDIUMCVSS 4.3EG 6.5
2022-11-02
A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The at…
CVE-2022-3817MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component mp4mux. The manipulation leads to memory leak. The attack can be launched remotel…
CVE-2022-3816MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The expl…
CVE-2022-3815MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4. This issue affects some unknown processing of the component mp4decrypt. The manipulation leads to memory leak. The attack may be initiated remotely. …
CVE-2022-3814MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been…
CVE-2022-3813MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has bee…
CVE-2022-3812MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may…
CVE-2022-3807MEDIUMCVSS 4.3EG 6.5
2022-11-01
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attac…
CVE-2022-3318MEDIUMCVSS 4.3EG 6.5
2022-11-01
Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to reboot Chrome OS to potentially exploit heap corruption via UI interaction. (Chromium security s…
CVE-2022-3299MEDIUMCVSS 4.3EG 6.5
2022-09-26
A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality in the library lib/sbi/client.c of the component AMF. The manipulation leads to denial of se…
CVE-2022-28875MEDIUMCVSS 4.3EG 6.5
2022-05-25
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
CVE-2022-1289MEDIUMCVSS 4.3EG 6.5
2022-04-10
A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. T…
CVE-2022-1210MEDIUMCVSS 4.3EG 6.5
2022-04-03
A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requir…
CVE-2013-1054MEDIUMCVSS 4.3EG 6.5
2021-04-07
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20…
CVE-2022-23242MEDIUMCVSS 6.3EG 6.3
2022-03-23
TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash conn…
CVE-2021-1093MEDIUMCVSS 6.2EG 6.2
2021-07-22
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that…
CVE-2026-35667MEDIUMCVSS 6.1EG 6.1
2026-04-10
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers…
CVE-2026-127123MEDIUMCVSS 6.0EG 6.0
2026-11-13
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not …
CVE-2026-17610MEDIUMCVSS 6.0EG 6.0
2026-08-27
In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.
CVE-2026-4988MEDIUMCVSS 5.9EG 5.9
2026-03-27
A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remot…
CVE-2025-58473MEDIUMCVSS 5.9EG 5.9
2025-09-23
An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exh…
CVE-2025-57882MEDIUMCVSS 5.9EG 5.9
2025-09-23
An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exh…
CVE-2025-52982MEDIUMCVSS 5.9EG 5.9
2025-07-11
An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an MX Series device wit…
CVE-2023-45802MEDIUMCVSS 5.9EG 5.9
2023-10-23
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests a…
CVE-2021-40122MEDIUMCVSS 5.9EG 5.9
2021-10-21
A vulnerability in an API of the Call Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper handling of large series of me…
CVE-2021-26906MEDIUMCVSS 5.9EG 5.9
2021-02-18
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerabil…
CVE-2018-1000808MEDIUMCVSS 5.9EG 5.9
2018-10-08
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is ex…
CVE-2019-1705MEDIUMCVSS 5.3EG 5.9
2019-05-03
A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated, remote attacker to cause a denial of service (DoS) condition on the remote access VPN services. The…
CVE-2025-13524MEDIUMCVSS 5.7EG 5.7
2025-11-21
Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call participant to continue receiving audio input from another user after they close their call window. …
CVE-2022-3563MEDIUMCVSS 3.5EG 5.7
2022-10-17
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to nu…
CVE-2022-3533MEDIUMCVSS 3.5EG 5.7
2022-10-17
A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory le…
CVE-2024-4013MEDIUMCVSS 5.6EG 5.6
2024-06-06
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the…

Map vulnerabilities like CWE-404 to your infrastructure

EchelonGraph correlates every CVE — across CWE-404 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →