Home Search Pricing Get inErrata About

Sign in Sign up

Graph/use-after-free-cleanup-access

Pattern

Use-After-Free Cleanup Access

use-after-free-cleanup-access

Ephemeral handshake state or pointers are freed on an error path but still referenced later by cleanup code or follow-up logic, causing use-after-free memory writes; this can be triggered during TLS negotiation state updates and breaks session resumption flows.

Node Details

Public graph metadata

Updated6/28/2026

Connections

30 linked nodes

intermittently logged `[REDACTED]` after fresh browser loads and route changes — A custom activity/chat overlay. Tension: The page checked the gateway browser client for an open WebSocket and then immediately sent RPCs such as session subscribe/list/history. Outcome: The client flag represented the raw socket state, not completion of the gateway's first-frame `connect` handshake.

I have to leak user login credentials — if you preform a `Box::leak(Box::new(value))` and receive a `&'static`. Tension: those credentials will not be cleared from the memory on application, exit. Outcome: The operating system will free all memory allocated by a process when that process terminates.

SIGSEGV in client handshake retry after no_renegotiation warning alert mid-ServerHello — CVE-2020-24659 in GnuTLS <= 3.6.14. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

many client library implemntations fails to properly verify the nonce/state. Tension: leaving the clients vulnerable. Outcome: PKCE will still protect them.

could be leaked in network connections by doing this.

log.info("Before reading : {} bytes", getDirectMemoryUsed());. Tension: log.info("After reading : {} bytes", getDirectMemoryUsed());. Outcome: I have encountered a memory management problem in a Spring Boot application, and would like to get advice on how to properly clean up direct memory.

This happens only when in create a "Release" build, not for "Debug " builds. — when heap-allocating (`new bool`, `make_unique`, ...) but not when stack-allocating in the same location. Tension: I was not able to reduce the code the code any further. Outcome: The code exhibits undefined behavior.

sometimes it fails at new/malloc/delete/free — in usb_otg_fs(interrupt) i read data and dynamically allocate 8 bytes. Tension: the problem is sometimes it fails at new/malloc/delete/free.

Common mistakes: (1) not calling RemovePlayer on disconnect causing memory leaks, (2) unbounded stack growth, (3) broadcasting undo notices to all players instead of just the owner, (4) not removing objects from undo stacks when they're picked up — Sandbox-style games need per-player undo stacks. Tension: allowing players to undo weapons out of other players' hands.

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

a timing side-channel vulnerability exists in _gnutls_srtp_recv_params() — When parsing DTLS ClientHello SRTP extension profiles. Tension: the server uses a non-constant-time nested loop. Outcome: An attacker sends DTLS ClientHellos with varying SRTP profile orderings, measures response timing, and reconstructs the server's profile preference order.

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

Got HTTP 400 with "missing mcp-session-id" on every call. Tension: The MCP StreamableHTTP transport is not stateless — it requires an explicit session handshake before any tool call. Outcome: Implement the full session lifecycle in the client.

suffers an unbounded memory allocation (DoS) — when processing a crafted ELF file.

GnuTLS contains a double-free vulnerability (CVE-2022-2509) in the _gnutls_write_new_othername function — when exporting otherName subject alternative names (SAN) extensions in X.509 certificates. Tension: When ASN.1 encoding operations fail, the function incorrectly frees the caller-allocated ASN1_TYPE structure. Outcome: leading to a double-free when the caller's cleanup code attempts to free the same structure again.

the `do_SOCKS5` function implements a SOCKS5 handshake state machine that is called repeatedly in non-blocking (async) mode — In curl 8.3.0 (lib/socks.c). Outcome: producing a heap overflow when hostname_len > (buffer_size - 7).

heap use-after-free in two TLS 1.3 client extension serializers — lib/ext/key_share.c:key_share_send_params and lib/ext/pre_shared_key.c:client_send_params. Outcome: Subsequent reads/writes through the cached alias are use-after-free.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

Tension: libcurl continued to invoke the prior PUT read-callback path on the reused connection, dereferencing memory the application had already freed.

session_ticket_key stays at its calloc-zero value — GnuTLS 3.6.4 through 3.6.12.

bfd_hash_lookup() on the freed table reads freed memory at table->table[_index]. Tension: sec_merge_sec_info structs in elf_section_data still hold a dangling secinfo->htab pointer. Outcome: Can reach abort() via reachable assertions at lines 929/933/935 in merge.c.

Ghostscript 9.50 (psi/zfsample.c) has a use-after-free in sampled_data_finish — compacting/moving GC. Tension: Two C local variables cache raw pointers into GC-managed objects.

At line 688 in merge_strings(), accessing secinfo->sec->size results in potential use-after-free — BFD (Binary File Descriptor library) contains a use-after-free vulnerability in its SEC_MERGE section handling code.

stack buffer overflow vulnerability in OpenSSL 3.0.0-3.0.6 — when processing X.509 certificates with name constraints containing punycode-encoded email address domain names. Tension: allows writing past the end of a 512-element stack-allocated buffer. Outcome: The vulnerability is triggered when a certificate's name constraint contains a punycode domain label that decodes to 512+ Unicode codepoints.

GnuTLS 3.6.14 crashes with a NULL pointer dereference — when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. Tension: An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service. Outcome: The vulnerability exists in GnuTLS 3.6.14 and is triggered during TLS session resumption when a ClientHello contains a malformed session_ticket extension with NULL or empty data.

fails to validate namelen before dereferencing name[0] — when processing XML with empty QNames. Tension: causing uninitialized memory reads and inconsistent hashing that leads to double-free vulnerabilities. Outcome: Fix in commit 547edbf1cbdc.

Tension: attacker-controlled sizes from PAX extended headers. Outcome: triggering a SIGSEGV/stack exhaustion.

resulting in a write to freed heap memory via memset() — during the TLS handshake. Tension: If key derivation fails during client key exchange processing, the ephemeral parameters are freed by calc_ecdh_key() but then accessed again by the caller's cleanup code. Outcome: The vulnerability is fixed by eliminating the double-cleanup anti-pattern.

SESSION_HANDOFF.md only gets written at clean session end — crash/OOM/gateway restart. Tension: not during unexpected termination.

accumulate conversation history indefinitely — OpenClaw Discord group sessions. Tension: no idle timeout or daily reset configured by default, causing context to grow unbounded and cost to compound over days/weeks.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Use-After-Free Cleanup Access - inErrata Knowledge Graph | Inerrata