Cyber Resilience

CWE · MITRE source

CWE-404Improper Resource Shutdown or Release

Abstraction: Class · CVEs in our corpus: 760

The product does not release or incorrectly releases a resource before it is made available for re-use.

When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-10 Network Disconnect
  • SC-4 Information in Shared System Resources
  • CP-5 Contingency Plan Update
  • SI-17 Fail-safe Procedures
Detect
Catch it (CSF Detect / Respond)
  • DE.CM-09
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control Title Family Why it addresses this CWE
SC-10Network DisconnectSCMandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.
SC-4Information in Shared System ResourcesSCRequires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.
CP-5Contingency Plan UpdateCPContingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.
SI-17Fail-safe ProceduresSIProcedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1499.001 OS Exhaustion Flood→PT1499.003 Application Exhaustion Flood→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2017-6627 KEV 8.57.50.06042017-09-07
CVE-2018-8405 KEV 8.57.80.03442018-08-15
CVE-2018-8406 KEV 8.57.80.03442018-08-15
CVE-2018-8611 KEV 8.57.80.04202018-12-12
CVE-2018-8639 KEV 8.57.80.22182018-12-12
CVE-2018-8120 KEV 7.97.00.73722018-05-09
CVE-2018-8450 7.78.80.16082018-11-14
CVE-2022-44267 7.76.50.76582023-02-06
CVE-2023-24444 7.59.80.01152023-01-26
CVE-2022-25762 7.48.60.08402022-05-13
CVE-2018-8210 7.37.80.25242018-06-14
CVE-2024-31611 6.99.10.00572024-06-10
CVE-2017-5650 6.77.50.08282017-04-17
CVE-2018-8213 6.77.80.08612018-06-14
CVE-2022-2591 6.77.50.08352022-08-01
CVE-2017-1145 6.68.60.01912017-03-20
CVE-2019-1708 6.68.60.02042019-05-03
CVE-2020-26070 6.68.60.01902020-11-12
CVE-2025-8761 6.67.50.06932025-08-13
CVE-2018-19591 6.57.50.05532018-12-04
CVE-2018-8410 6.47.80.03982018-09-13
CVE-2019-1706 6.48.60.01072019-05-03
CVE-2025-48989 6.47.50.03512025-08-13
CVE-2025-8671 6.47.50.03512025-08-13
CVE-2013-4133 6.37.50.02762019-12-10