CWE - CWE-401: Missing Release of Memory after Effective Lifetime (4.18)

Home > CWE List > CWE-401: Missing Release of Memory after Effective Lifetime (4.18)

CWE Glossary Definition

CWE-401: Missing Release of Memory after Effective Lifetime

Weakness ID: 401

Vulnerability Mapping: ALLOWED This CWE ID may be used to map to real-world vulnerabilities
Abstraction: Variant Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.

View customized information:

For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.

Edit Custom Filter

Description

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. Diagram for CWE-401

Alternate Terms

Memory Leak

Common Consequences

Section HelpThis table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

Impact	Details
DoS: Crash, Exit, or Restart; DoS: Instability; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)	Scope: Availability Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advantage of other unexpected program behavior resulting from a low memory condition.
Reduce Performance	Scope: Other

Potential Mitigations

Phase(s)	Mitigation
Implementation	Strategy: Libraries or Frameworks Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391]. To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Architecture and Design	Use an abstraction library to abstract away risky APIs. Not a complete solution.
Architecture and Design; Build and Compilation	The Boehm-Demers-Weiser Garbage Collector or valgrind can be used to detect leaks in code. Note: This is not a complete solution as it is not 100% effective.

Relationships

Section Help This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

Relevant to the view "Research Concepts" (View-1000)

Nature	Type	ID	Name
ChildOf	Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	772	Missing Release of Resource after Effective Lifetime
CanFollow	Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.	390	Detection of Error Condition Without Action

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (View-1003)

Nature	Type	ID	Name
ChildOf	Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	404	Improper Resource Shutdown or Release

Relevant to the view "CISQ Quality Measures (2020)" (View-1305)

Nature	Type	ID	Name
ChildOf	Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.	404	Improper Resource Shutdown or Release

Modes Of Introduction

Section HelpThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

Phase	Note
Implementation	Memory leaks have two common and sometimes overlapping causes: Error conditions and other exceptional circumstances often triggered by improper handling of malformed data or unexpectedly interrupted sessions. Confusion over which part of the program is responsible for freeing the memory, since in some languages, developers are responsible for tracking memory allocation and releasing the memory. If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.

Phase

Note

Implementation

Memory leaks have two common and sometimes overlapping causes:

Error conditions and other exceptional circumstances often triggered by improper handling of malformed data or unexpectedly interrupted sessions.
Confusion over which part of the program is responsible for freeing the memory, since in some languages, developers are responsible for tracking memory allocation and releasing the memory. If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.

Applicable Platforms

Section HelpThis listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

C (Undetermined Prevalence)

C++ (Undetermined Prevalence)

Likelihood Of Exploit

Medium

Demonstrative Examples

Example 1

The following C function leaks a block of allocated memory if the call to read() does not return the expected number of bytes:

(bad code)

Example Language: C

char* getBlock(int fd) {

char* buf = (char*) malloc(BLOCK_SIZE);
if (!buf) {

return NULL;

}
if (read(fd, buf, BLOCK_SIZE) != BLOCK_SIZE) {

return NULL;

}
return buf;

}

Selected Observed Examples

Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

Reference	Description
CVE-2005-3119	Memory leak because function does not free() an element of a data structure.
CVE-2004-0427	Memory leak when counter variable is not decremented.
CVE-2002-0574	chain: reference count is not decremented, leading to memory leak in OS by sending ICMP packets.
CVE-2005-3181	Kernel uses wrong function to release a data structure, preventing data from being properly tracked by other code.
CVE-2004-0222	Memory leak via unknown manipulations as part of protocol test suite.
CVE-2001-0136	Memory leak via a series of the same command.

Weakness Ordinalities

Ordinality	Description
Resultant	(where the weakness is typically related to the presence of some other weaknesses)

Detection Methods

Method	Details
Fuzzing	Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. Effectiveness: High
Automated Static Analysis	Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Effectiveness: High

Method

Details

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Effectiveness: High

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Functional Areas

Memory Management

Affected Resources

Memory

Memberships

Section HelpThis MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.

Nature	Type	ID	Name
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	398	7PK - Code Quality
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	730	OWASP Top Ten 2004 Category A9 - Denial of Service
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	861	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	1152	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	1162	SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	1238	SFP Primary Cluster: Failure to Release Memory
MemberOf	CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.	1399	Comprehensive Categorization: Memory Safety

Vulnerability Mapping Notes

Usage ALLOWED

(this CWE ID may be used to map to real-world vulnerabilities)

Reason Acceptable-Use

Rationale

This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notes

Relationship

This is often a resultant weakness due to improper handling of malformed data or early termination of sessions.

Terminology

"memory leak" has sometimes been used to describe other kinds of issues, e.g. for information leaks in which the contents of memory are inadvertently leaked (CVE-2003-0400 is one such example of this terminology conflict).

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER	Memory leak
7 Pernicious Kingdoms	Memory Leak
CLASP	Failure to deallocate data
OWASP Top Ten 2004	A9	CWE More Specific	Denial of Service
CERT C Secure Coding	MEM31-C	Exact	Free dynamically allocated memory when no longer needed
The CERT Oracle Secure Coding Standard for Java (2011)	MSC04-J	Do not leak memory
Software Fault Patterns	SFP14	Failure to Release Resource
OMG ASCPEM	ASCPEM-PRF-14

References

[REF-18] Secure Software, Inc.. "The CLASP Application Security Process". 2005.
<https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf>. (URL validated: 2024年11月17日)

[REF-390] J. Whittaker and H. Thompson. "How to Break Software Security". Addison Wesley. 2003.

[REF-391] iOS Developer Library. "Transitioning to ARC Release Notes". 2013年08月08日.
<https://developer.apple.com/library/archive/releasenotes/ObjectiveC/RN-TransitioningToARC/Introduction/Introduction.html>. (URL validated: 2023年04月07日)

[REF-959] Object Management Group (OMG). "Automated Source Code Performance Efficiency Measure (ASCPEM)". ASCPEM-PRF-14. 2016-01.
<https://www.omg.org/spec/ASCPEM/>. (URL validated: 2023年04月07日)

Content History

Submissions
Submission Date	Submitter	Organization
2006年07月19日 (CWE Draft 3, 2006年07月19日)	PLOVER
2006年07月19日 (CWE Draft 3, 2006年07月19日)
Modifications
Modification Date	Modifier	Organization
2025年04月03日 (CWE 4.17, 2025年04月03日)	CWE Content Team	MITRE
2025年04月03日 (CWE 4.17, 2025年04月03日)	updated Description, Diagram, Modes_of_Introduction
2023年06月29日	CWE Content Team	MITRE
2023年06月29日	updated Mapping_Notes
2023年04月27日	CWE Content Team	MITRE
2023年04月27日	updated Detection_Factors, References, Relationships, Time_of_Introduction
2023年01月31日	CWE Content Team	MITRE
2023年01月31日	updated Common_Consequences, Description
2022年10月13日	CWE Content Team	MITRE
2022年10月13日	updated Taxonomy_Mappings
2021年03月15日	CWE Content Team	MITRE
2021年03月15日	updated Relationships
2020年08月20日	CWE Content Team	MITRE
2020年08月20日	updated Relationships
2020年02月24日	CWE Content Team	MITRE
2020年02月24日	updated References, Relationships, Taxonomy_Mappings
2019年06月20日	CWE Content Team	MITRE
2019年06月20日	updated Description, Name
2019年01月03日	CWE Content Team	MITRE
2019年01月03日	updated Common_Consequences, Demonstrative_Examples, Name, References, Relationships, Taxonomy_Mappings, Type, Weakness_Ordinalities
2017年11月08日	CWE Content Team	MITRE
2017年11月08日	updated References, Relationships, Taxonomy_Mappings, White_Box_Definitions
2014年07月30日	CWE Content Team	MITRE
2014年07月30日	updated Relationships, Taxonomy_Mappings
2014年02月18日	CWE Content Team	MITRE
2014年02月18日	updated Potential_Mitigations, References
2013年02月21日	CWE Content Team	MITRE
2013年02月21日	updated Observed_Examples
2012年10月30日	CWE Content Team	MITRE
2012年10月30日	updated Potential_Mitigations
2012年05月11日	CWE Content Team	MITRE
2012年05月11日	updated Relationships, Taxonomy_Mappings
2011年06月01日	CWE Content Team	MITRE
2011年06月01日	updated Common_Consequences, Relationships, Taxonomy_Mappings
2011年03月29日	CWE Content Team	MITRE
2011年03月29日	updated Alternate_Terms
2010年12月13日	CWE Content Team	MITRE
2010年12月13日	updated Demonstrative_Examples, Name
2010年06月21日	CWE Content Team	MITRE
2010年06月21日	updated Other_Notes, Potential_Mitigations
2010年02月16日	CWE Content Team	MITRE
2010年02月16日	updated Relationships
2009年10月29日	CWE Content Team	MITRE
2009年10月29日	updated Modes_of_Introduction, Other_Notes
2009年07月27日	CWE Content Team	MITRE
2009年07月27日	updated White_Box_Definitions
2009年07月17日	KDM Analytics
2009年07月17日	Improved the White_Box_Definition
2009年05月27日	CWE Content Team	MITRE
2009年05月27日	updated Name
2009年03月10日	CWE Content Team	MITRE
2009年03月10日	updated Other_Notes
2008年10月14日	CWE Content Team	MITRE
2008年10月14日	updated Description
2008年09月08日	CWE Content Team	MITRE
2008年09月08日	updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, References, Relationship_Notes, Taxonomy_Mappings, Terminology_Notes
2008年08月15日	Veracode
2008年08月15日	Suggested OWASP Top Ten 2004 mapping
2008年08月01日	KDM Analytics
2008年08月01日	added/updated white box definitions
2008年07月01日	Eric Dalci	Cigital
2008年07月01日	updated Time_of_Introduction
Previous Entry Names
Change Date	Previous Entry Name
2008年04月11日	Memory Leak
2009年05月27日	Failure to Release Memory Before Removing Last Reference (aka 'Memory Leak')
2010年12月13日	Failure to Release Memory Before Removing Last Reference ('Memory Leak')
2019年01月03日	Improper Release of Memory Before Removing Last Reference ('Memory Leak')
2019年06月20日	Improper Release of Memory Before Removing Last Reference

More information is available — Please edit the custom filter or select a different filter.

Page Last Updated: September 09, 2025

MITRE

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

HSSEDI