Skip to main content

Missing Release of Resource after Effective Lifetime in mysql:mysql-connector-java

Cx7ef609d2-efb5

  • mysql:mysql-connector-java
High
7.5/10

Summary

MySQL Connector/J before 5.1.31 is vulnerable to Memory Leak. Upon continuous interruption between the server and the database, the dead connections are accumulated in a map in `ProfilerEventHandlerFactory` factory and aren't removed from the memory. When the number of database connections reaches a certain number, it causes the application to throw an OutOfMemoryException as the garbage collector fails to collect the dead connections.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-772 - Missing Release Of Resource After Effective Lifetime

'Missing release of resource after effective lifetime' is a weakness that occurs when software doesn't sufficiently release a resource (e.g. memory, CPU, disk space, etc.) after it is used. If not addressed, attackers can launch a denial of service attack (by allocating a resource and not releasing it).

References

Advisory Timeline

  • Published