CWEweakness

CWE-664 Improper Control of a Resource Through its Lifetime

Official page ↗
Abstraction
Pillar
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Common consequences

• Other: Varies by Context — When code does not follow the instructions for resource management, it can lead to unexpected behaviors and potentially exploitable states.

Detection methods

• Automated Static Analysis: Use Static analysis tools to check for unreleased resources.

Observed examples

• CVE-2018-1000613: Cryptography API uses unsafe reflection when deserializing a private key • CVE-2019-19911: Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).

Related

Attack pattern · CAPEC (5)

  • CAPEC-196 Session Credential Falsification through Forging attack pattern
  • CAPEC-21 Exploitation of Trusted Identifiers attack pattern
  • CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
  • CAPEC-61 Session Fixation attack pattern
  • CAPEC-62 Cross Site Request Forgery attack pattern

Observed example · CVE (2)

  • CVE-2019-19911 There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer… vulnerability
  • CVE-2018-1000613 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of… vulnerability

Referenced by CAPEC · weakness (5)

  • CAPEC-196 Session Credential Falsification through Forging attack pattern
  • CAPEC-21 Exploitation of Trusted Identifiers attack pattern
  • CAPEC-60 Reusing Session IDs (aka Session Replay) attack pattern
  • CAPEC-61 Session Fixation attack pattern
  • CAPEC-62 Cross Site Request Forgery attack pattern

Referenced by CVE · weakness (66)

  • CVE-2026-57187 Asterisk is an open source private branch exchange and telephony toolkit. vulnerability
  • CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
  • CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
  • CVE-2026-94192 A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back… vulnerability
  • CVE-2026-57446 libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. vulnerability
  • CVE-2026-68908 libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. vulnerability
  • CVE-2026-102026 An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and… vulnerability
  • CVE-2026-76282 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
  • CVE-2026-76467 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a… vulnerability
  • CVE-2026-76500 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller… vulnerability
  • CVE-2026-20336 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software,… vulnerability
  • CVE-2026-54251 netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. vulnerability
  • CVE-2026-20353 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and… vulnerability
  • CVE-2026-86203 PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. vulnerability
  • CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. vulnerability
  • CVE-2026-20274 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a… vulnerability
  • CVE-2026-79289 Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had… vulnerability
  • CVE-2026-18549 @fastify/multipart is a multipart form-data parser for Fastify. vulnerability
  • CVE-2026-72041 In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send… vulnerability
  • CVE-2026-19380 A vulnerability was identified in Mullvad wireguard.sys 0.10.1. vulnerability
  • CVE-2026-20269 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a… vulnerability
  • CVE-2026-64721 This issue was addressed through improved state management. vulnerability
  • CVE-2026-20158 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a… vulnerability
  • CVE-2026-43503 In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers… vulnerability
  • CVE-2026-8517 Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage… vulnerability
  • CVE-2026-8582 Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive… vulnerability
  • CVE-2026-43158 In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592… vulnerability
  • CVE-2025-34226 OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program… vulnerability
  • CVE-2025-54612 Iterator failure vulnerability in the card management module. vulnerability
  • CVE-2025-54613 Iterator failure vulnerability in the card management module. vulnerability
Show all 66 ›

Referenced by CWE · child of (28)

  • CWE-118 Incorrect Access of Indexable Resource weakness
  • CWE-1229 Creation of Emergent Resource weakness
  • CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State weakness
  • CWE-1329 Reliance on Component That is Not Updateable weakness
  • CWE-1472 Generation of Credential with Long Expiration weakness
  • CWE-1473 Improper Expiration of Cached Data weakness
  • CWE-1474 Non-Equivalent Data Transformation weakness
  • CWE-1475 Incomplete Data/State Propagation weakness
  • CWE-221 Information Loss or Omission weakness
  • CWE-372 Incomplete Internal State Distinction weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-404 Improper Resource Shutdown or Release weakness
  • CWE-410 Insufficient Resource Pool weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness
  • CWE-487 Reliance on Package-level Scope weakness
  • CWE-501 Trust Boundary Violation weakness
  • CWE-580 clone() Method Without super.clone() weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness
  • CWE-662 Improper Synchronization weakness
  • CWE-665 Improper Initialization weakness
  • CWE-666 Operation on Resource in Wrong Phase of Lifetime weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres weakness
  • CWE-673 External Influence of Sphere Definition weakness
  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness
  • CWE-911 Improper Update of Reference Count weakness
  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

Referenced by CWE · has member (1)

  • CWE-1000 Complete Weakness Hierarchy view