CWEweakness
CWE-459 Incomplete Cleanup
- Alternate terms
- Insufficient Cleanup
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific, Python
- CWE version
- 5.0
Description
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Common consequences
• Other, Confidentiality, Integrity: Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other) — It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.
Potential mitigations
• [Architecture and Design, Implementation] Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2000-0552: World-readable temporary file not deleted after use.
• CVE-2005-2293: Temporary file not deleted after use, leaking database usernames and passwords.
• CVE-2002-0788: Interaction error creates a temporary file that can not be deleted due to strong permissions.
• CVE-2002-2066: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
• CVE-2002-2067: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
• CVE-2002-2068: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
• CVE-2002-2069: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
• CVE-2002-2070: Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
• CVE-2005-1744: Users not logged out when application is restarted after security-relevant changes were made.
Related
Observed example · CVE (9)
- CVE-2005-2293 Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows… vulnerability
- CVE-2005-1744 BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows… vulnerability
- CVE-2002-2066 BestCrypt BCWipe 1.0.7 and 2.0 through 2.35.1 does not clear Windows alternate data streams that are attached to files on NTFS file… vulnerability
- CVE-2002-2067 East-Tec Eraser 2002 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers… vulnerability
- CVE-2002-2068 Eraser 5.3 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover… vulnerability
- CVE-2002-2069 PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to… vulnerability
- CVE-2002-2070 SecureClean 3 build 2.0 does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows… vulnerability
- CVE-2002-0788 An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a… vulnerability
- CVE-2000-0552 ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to… vulnerability
Child of · CWE (1)
- CWE-404 Improper Resource Shutdown or Release weakness
Referenced by CVE · weakness (256)
- CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. vulnerability
- CVE-2026-115478 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. vulnerability
- CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. vulnerability
- CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. vulnerability
- CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. vulnerability
- CVE-2026-110008 @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. vulnerability
- CVE-2026-112180 MISP contains a data integrity flaw in its event deletion logic. vulnerability
- CVE-2026-109869 undici is an HTTP client library for Node.js. vulnerability
- CVE-2026-17525 Incomplete cleanup vulnerability in ABB My Control System. vulnerability
- CVE-2026-102030 An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor… vulnerability
- CVE-2026-103937 Misskey is an open source, federated social media platform. vulnerability
- CVE-2026-108982 VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. vulnerability
- CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary… vulnerability
- CVE-2026-49484 Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. vulnerability
- CVE-2026-19739 The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while… vulnerability
- CVE-2026-19740 The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried… vulnerability
- CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed… vulnerability
- CVE-2026-107332 Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain… vulnerability
- CVE-2026-106203 Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… vulnerability
- CVE-2026-106243 Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via… vulnerability
- CVE-2026-106262 Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer… vulnerability
- CVE-2026-106294 Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access… vulnerability
- CVE-2026-106366 Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin… vulnerability
- CVE-2026-106375 Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside… vulnerability
- CVE-2026-106394 Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak… vulnerability
- CVE-2026-104421 Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by… vulnerability
- CVE-2026-104427 Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall… vulnerability
- CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. vulnerability
- CVE-2026-95303 Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass… vulnerability
- CVE-2026-95326 Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass… vulnerability