VNX-404: Improper Resource Shutdown or Release

Field	Value
Rule ID	VNX-404
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-404
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	resource-release cwe-404
Source	internal/sast/rules/vnx-404.rego

Overview

VNX-404 maps to CWE-404: Improper Resource Shutdown or Release. A Java file or database handle bound to a local variable is never released before the method ends: streams, readers, writers, ZipFile/JarFile and JDBC connections opened outside try-with-resources and never closed, returned or wrapped.

A Python file or socket handle that is never closed (x = open(...), socket.socket(), os.open() and friends) is reported by VNX-775, which owns that shape; this rule does not read Python, so one leaked handle is reported once.

Why This Matters

This weakness class (CWE-404) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-404 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

FileInputStream in = new FileInputStream(file);                          // FLAGGED
props.load(in);
return props;

Connection conn = DriverManager.getConnection(url, "app", pass);         // FLAGGED
ResultSet rs = conn.createStatement().executeQuery("SELECT COUNT(*) FROM users");

Not flagged: a close in finally, a handle returned, stored in a field or in a collection, try (BufferedReader r = ...) including multi-line resource headers, IOUtils.closeQuietly(in), new BufferedReader(fr) wrapping the handle, and test files. A handle closed only on the success path is not reported. Python files are not read here: VNX-775 reports their leaked handles.

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-404 or a false positive.
2. Open the handle in a try-with-resources statement, or close it in a finally block.
3. For confirmed false positives, add a // vulnetix-ignore: VNX-404 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-404: Improper Resource Shutdown or Release
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-404
// nosec vnx-404

Or record an ignore rule: vulnetix ignore add --rule vnx-404 --reason "...". See Suppressing findings.