CWE-583: finalize() Method Declared Public

Extended Description

A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

Code Examples & CVEs

Demonstrative Examples

The following Java Applet code mistakenly declares a public finalize() method.

Mobile code, in this case a Java Applet, is code that is transmitted across a network and executed on a remote machine. Because mobile code developers have little if any control of the environment in which their code will execute, special security concerns become relevant. One of the biggest environmental threats results from the risk that the mobile code will run side-by-side with other, potentially malicious, mobile code. Because all of the popular web browsers execute code from multiple sources together in the same JVM, many of the security guidelines for mobile code are focused on preventing manipulation of your objects' state and behavior by adversaries who have access to the same virtual machine where your product is running.

BadJava

public final class urlTool extends Applet {public void finalize() {...}...}

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-583 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-583, finalize() Method Declared Public, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address finalize() Method Declared Public during Implementation

MITRE associates mitigation with Implementation; documented detection approaches include Automated Static Analysis; recorded impacts include Alter Execution Logic, Execute Unauthorized Code or Commands, and Modify Application Data. Use these source-defined anchors to turn CWE-583 into implementation, review, and verification checks for the affected component.

CWE-583: finalize() Method Declared Public — MITRE CWE

Triage CWE-583 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-583, finalize() Method Declared Public, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-583

Apply MITRE's full root-cause mapping guidance when using CWE-583, finalize() Method Declared Public. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-583 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-583, finalize() Method Declared Public. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-583: finalize() Method Declared Public?+

CWE-583: finalize() Method Declared Public is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product violates secure coding principles for mobile code by declaring a finalize() method public. A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

What are the security consequences of finalize() Method Declared Public?+

If exploited, CWE-583 (finalize() Method Declared Public) it can compromise Confidentiality, Integrity and Availability, leading to outcomes such as Alter Execution Logic, Execute Unauthorized Code or Commands and Modify Application Data.

How do you prevent or mitigate finalize() Method Declared Public?+

Recommended mitigations for CWE-583 include: If you are using finalize() as it was designed, there is no reason to declare finalize() with anything other than protected access.

Which programming languages are affected by finalize() Method Declared Public?+

CWE-583 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-583 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-583: finalize() Method Declared Public

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods