VNX-586: Explicit Call to Finalize()

Field	Value
Rule ID	VNX-586
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-586
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	object-finalize cwe-586
Source	internal/sast/rules/vnx-586.rego

Overview

VNX-586 maps to CWE-586: Explicit Call to Finalize(). It reports x.finalize(), this.finalize(), getX().finalize(), a .finalize() that continues a call chain on the next line, and a bare finalize(); statement.

Why This Matters

The garbage collector runs a finalizer once, when the object is unreachable. Calling it directly runs the cleanup while the object is still referenced, so later use works on released resources, and the collector may run it a second time.

What Gets Flagged

resource.finalize();
this.finalize();
r.finalize ( );

Not flagged: super.finalize() inside an overriding finalize(), the protected void finalize() declaration, builder.finalize(ctx), builder.finalizeBuild(), System.runFinalization(), comments, strings and test files.

Remediation

1. Give the class an explicit close() method (implement AutoCloseable) and call that instead.
2. Use try-with-resources or java.lang.ref.Cleaner for native resources.

References

• CWE-586: Explicit Call to Finalize()
• SEI CERT MET12-J: Do not use finalizers

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-586
// nosec vnx-586

Or record an ignore rule: vulnetix ignore add --rule vnx-586 --reason "...". See Suppressing findings.