CWE-568: finalize() Method Without super.finalize()

VariantDraft

The product contains a finalize() method that does not call super.finalize().

View on MITRE
Back to CWE Lookup

Extended Description

The Java Language Specification states that it is a good practice for a finalize() method to call super.finalize().

Technical Details

Structure
Simple

Applicable To

Languages
Java
Platforms

Frequently Asked Questions

What is CWE-568: finalize() Method Without super.finalize()?+

CWE-568: finalize() Method Without super.finalize() is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product contains a finalize() method that does not call super.finalize(). The Java Language Specification states that it is a good practice for a finalize() method to call super.finalize().

What are the security consequences of finalize() Method Without super.finalize()?+

If exploited, CWE-568 (finalize() Method Without super.finalize()) it can compromise Other, leading to outcomes such as Quality Degradation.

How do you prevent or mitigate finalize() Method Without super.finalize()?+

Recommended mitigations for CWE-568 include: Call the super.finalize() method. Use static analysis tools to spot such issues in your code.

Which programming languages are affected by finalize() Method Without super.finalize()?+

CWE-568 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-568 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More