CWE-459: Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Consequences

• Other, Confidentiality, Integrity: Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other)

How to prevent it

• Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

Recent advisories

• GHSA-qhcq-9pm2-c9w9 — ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
• GHSA-xjj6-f33q-929c — undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
• GHSA-vc2v-76pw-4v95 — compression vulnerable to Denial of Service via memory leak on premature response close
• GHSA-2vg6-77g8-24mp — Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
• GHSA-2gf8-q9rr-jq3h — zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
• GHSA-4m69-67m6-prqp — Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache
• GHSA-rfjg-6m84-crj2 — Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
• GHSA-rg58-xhh7-mqjw — Apache Struts has a Denial of Service vulnerability
• GHSA-xx7v-hqxh-cjr9 — Apache Struts is Vulnerable to DoS via File Leak
• GHSA-3p2h-wqq4-wf4h — Apache Tomcat Denial of Service via invalid HTTP priority header
• GHSA-8fx8-pffw-w498 — SiYuan has an arbitrary file deletion vulnerability
• GHSA-p2cj-86v4-7782 — Moodle HTTP authorization header is preserved between "emulated redirects"
• GHSA-729q-fcgp-r5xh — Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
• GHSA-g8pj-r55q-5c2v — Apache Tomcat Incomplete Cleanup vulnerability
• GHSA-jm7m-8jh6-29hp — Apache Tomcat Incomplete Cleanup vulnerability

All advisories for CWE-459