CWE-909: Missing Initialization of Resource
ClassLikelihood of exploit: Medium
The product does not initialize a critical resource.
Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.
Consequences
- Confidentiality: Read Memory, Read Application Data
- Availability: DoS: Crash, Exit, or Restart
How to prevent it
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all specified steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile your product with settings that generate warnings about uninitialized variables or data.
Recent advisories
- GHSA-4vq8-7jfc-9cvp — Moby firewalld reload removes bridge network isolation
- GHSA-x4rx-4gw3-53p4 — Moby firewalld reload makes published container ports accessible from remote hosts
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor