CWE-226 Sensitive Information in Resource Not Removed Before Reuse
Description
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-226 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-4q3p-rj5x-xv7p | CVE-2026-106111 | MODERATE |
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate |
2026-10-07 | |
| GHSA-j22f-vq7h-c4qm | CVE-2026-92708 | HIGH |
devalue: `stringify`/`uneval` serialize shared memory |
2026-10-01 | |
| GHSA-x6m9-38vm-2xhf | - | HIGH |
Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset() |
2026-07-06 | |
| GHSA-r7p8-xq5m-436c | CVE-2026-5795 | HIGH |
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables |
2026-04-14 | |
| GHSA-gc59-r5jq-98qw | - | HIGH |
Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables |
2026-04-14 | |
| GHSA-9p93-7j67-5pc2 | - | HIGH |
OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding |
2026-03-27 | |
| GHSA-wh6w-3828-g9qf | CVE-2022-39393 | HIGH | - |
Wasmtime may have data leakage between instances in the pooling allocator |
2025-05-02 |
| GHSA-p2cj-86v4-7782 | CVE-2024-38275 | MODERATE | - |
Moodle HTTP authorization header is preserved between "emulated redirects" |
2025-05-01 |
| GHSA-5x7m-6737-26cr | CVE-2024-32036 | MODERATE |
SixLabors.ImageSharp vulnerable to data leakage |
2025-01-09 | |
| GHSA-86wm-rrjm-8wh8 | CVE-2020-27218 | MODERATE |
Buffer not correctly recycled in Gzip Request inflation |
2024-02-21 | |
| GHSA-r45x-ghr2-qjxc | - | HIGH | - |
Duplicate Advisory: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s |
2022-06-23 |