Missing Initialization of Resource

CWE-909

Overtime trend (NVD)

CVSS severity (NVD, All Time)

Per technology (GHSA, All time)

33%-RubyGems
33%-Pip
33%-Rust

Short description

The product does not initialize a critical resource.

Extended description

Many resources require initialization before they can be properly used. If a resource is not initialized, it could contain unpredictable or expired data, or it could be initialized to defaults that are invalid. This can have security implications when the resource is expected to have certain properties or values.

Best practices to prevent this CWE

Phase: Implementation

Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all specified steps.

Phase: Implementation

Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.

Phase: Implementation

Avoid race conditions (CWE-362) during initialization routines.

Phase: Build and Compilation

Run or compile your product with settings that generate warnings about uninitialized variables or data.

Recently published CVEs

CVE-2023-5138
CVE-2022-29968
CVE-2022-22704
CVE-2022-1016
CVE-2022-0382

Recently published GHSA

GHSA-8cw2-jv5c-c825
GHSA-cjw4-2w9r-r8mv
GHSA-24g6-5rx7-58wj
GHSA-6wp2-fw3v-mfmc

Prioritize and Uncover Reachable Vulnerabilities in Your Application Code

Identify externally reachable data flows and vulnerabilities for effective risk mitigation

Get a Demo