What CVEs are caused by CWE-402?

22 recorded CVEs are attributed to CWE-402, including CVE-2021-23264, CVE-2025-29925, CVE-2021-31410.

What are the consequences of CWE-402?

Exploiting CWE-402 can lead to: Read Application Data.

Is CWE-402 actively exploited?

22 recorded CVEs are caused by CWE-402; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Create an account

Class weakness

Draft

CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')

Also known as: Resource Leak

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Last updated May 1, 2026

22

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak')) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

22 recorded CVEs are caused by CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak')). The highest-severity and most recent are shown first. 0 new CWE-402 CVEs have been recorded so far in 2026 (9 in 2025).

CVE-2021-31407

OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure

High · CVSS 8.6 · EPSS 84th

2021-04-23

CVE-2025-48383

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

High · CVSS 8.2 · EPSS 22th

2025-05-27

CVE-2025-32360

High · CVSS 8.1 · EPSS 16th

2025-04-05

CVE-2025-67745

Myhoard logs backup encryption key in plain text

High · CVSS 7.5 · EPSS 4th

2025-12-18

CVE-2024-29900

@electron/packager's build process memory potentially leaked into final executable

High · CVSS 7.5 · EPSS 49th

2024-03-29

CVE-2022-3596

High · CVSS 7.5 · EPSS 65th

2023-09-20

CVE-2023-34467

XWiki Platform may retrieve email addresses of all users

High · CVSS 7.5 · EPSS 61th

2023-06-23

CVE-2021-23263

High · CVSS 7.5 · EPSS 77th

2021-12-02

CVE-2024-47146

High · CVSS 7.1 · EPSS 19th

2024-12-06

Showing 12 of 22 recorded CWE-402 CVEs. Get an alert for each new one, with AI-written analysis and fixes.

Monitor CWE-402 vulnerabilities

Common consequences

What can happen when CWE-402 is exploited.

Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2003-0740 — Server leaks a privileged file descriptor, allowing the server to be hijacked.
CVE-2004-1033 — File descriptor leak allows read of restricted files.

Terminology & mappings

Alternate terms

Resource Leak

Mapped taxonomies

PLOVER: Resource leaks

Frequently asked questions

Common questions about CWE-402.

What is CWE-402?: The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
What CVEs are caused by CWE-402?: 22 recorded CVEs are attributed to CWE-402, including CVE-2021-23264, CVE-2025-29925, CVE-2021-31410.
How is CWE-402 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-402?: Exploiting CWE-402 can lead to: Read Application Data.
Is CWE-402 actively exploited?: 22 recorded CVEs are caused by CWE-402; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-402 CVEs

Get an alert when a new CWE-402 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing