VNX-583: finalize() method declared public

Field	Value
Rule ID	VNX-583
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-583
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	finalize-public cwe-583
Source	internal/sast/rules/vnx-583.rego

Overview

VNX-583 maps to CWE-583: finalize() Method Declared Public. It reports a Java void finalize() declaration with no parameters whose modifiers include public, in any order and after annotations, and a Kotlin member fun finalize() with no visibility modifier or with public (Kotlin members are public by default).

Why This Matters

Object.finalize() is protected. Widening it to public lets any caller run the finalizer, which typically frees native memory or closes handles, while the object is still in use. A later access then works on released resources.

What Gets Flagged

public void finalize() throws Throwable {
public synchronized void finalize() {
@Override public void finalize()

class NativeHandle(private val ptr: Long) {
    fun finalize() { Native.free(ptr) }
}

Not flagged: protected void finalize(), Kotlin protected fun finalize() and top-level fun finalize(), public void finalize(int code), public void finalizeOrder(), calls such as s.finalize(), comments, strings and test files.

Remediation

1. Declare the override protected, as Object.finalize() is.
2. Prefer AutoCloseable with try-with-resources, or java.lang.ref.Cleaner; finalization is deprecated for removal.

References

• CWE-583: finalize() Method Declared Public
• SEI CERT MET12-J: Do not use finalizers

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-583
// nosec vnx-583

Or record an ignore rule: vulnetix ignore add --rule vnx-583 --reason "...". See Suppressing findings.