The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states.
Even without explicit instructions, various principles are expected to be adhered to, such as "Do not use an object until after its creation is complete," or "do not use an object after it has been slated for destruction."

Primary

Resultant

Implementation

Other
Other

Automated Static Analysis
Use Static analysis tools to check for unreleased resources.

This code allocates a socket and forks each time it receives a new connection.

sock=socket(AF_INET, SOCK_STREAM, 0);while (1) {newsock=accept(sock, ...);printf("A connection has been accepted\n");pid = fork();}

The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely.

CVE-2018-1000613
Cryptography API uses unsafe reflection when deserializing a private key
https://www.cve.org/CVERecord?id=CVE-2018-1000613

CVE-2019-19911
Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).
https://www.cve.org/CVERecord?id=CVE-2019-19911

FIO39-C
Do not alternately input and output from a stream without an intervening flush or positioning call
CWE More Abstract

Discouraged
This CWE entry is high-level when lower-level children are available.
Consider children or descendants of this entry instead.

More work is needed on this entry and its children. There are perspective/layering issues; for example, one breakdown is based on lifecycle phase (CWE-404, CWE-665), while other children are independent of lifecycle, such as CWE-400. Others do not specify as many bases or variants, such as CWE-704, which primarily covers numbers at this stage.

CWE Content Team
MITRE
2008-04-11
Draft 9
2008-04-11

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Maintenance_Notes, Relationships, Type

CWE Content Team
MITRE
2009-03-10
updated Related_Attack_Patterns

CWE Content Team
MITRE
2009-05-27
updated Description, Name, Relationships

CWE Content Team
MITRE
2009-07-27
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2010-12-13
updated Description, Relationships

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-02-21
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships, Type

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Maintenance_Notes, Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, Weakness_Ordinalities

Insufficient Control of a Resource Through its Lifetime