CWE-415
AllowedDouble Free
Abstraction: Variant · Status: Draft
The product calls free() twice on the same memory address.
1012 vulnerabilities reference this CWE, most recent first.
GHSA-XXMG-3GV9-85H2
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
{
"affected": [],
"aliases": [
"CVE-2020-14354"
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-415",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-13T14:15:00Z",
"severity": "LOW"
},
"details": "A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.",
"id": "GHSA-xxmg-3gv9-85h2",
"modified": "2022-05-24T19:02:23Z",
"published": "2022-05-24T19:02:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14354"
},
{
"type": "WEB",
"url": "https://github.com/c-ares/c-ares/commit/1cc7e83c3bdfaafbc5919c95025592d8de3a170e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1866838"
},
{
"type": "WEB",
"url": "https://c-ares.haxx.se/changelog.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/158755/GS20200804145053.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XXXV-9J5G-VQFC
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-07-30 12:32In the Linux kernel, the following vulnerability has been resolved:
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.
{
"affected": [],
"aliases": [
"CVE-2026-46189"
],
"database_specific": {
"cwe_ids": [
"CWE-1341",
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:34Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path\n\nSashiko points out that pvrdma_uar_free() is already called within\npvrdma_dealloc_ucontext(), so calling it before triggers a double free.",
"id": "GHSA-xxxv-9j5g-vqfc",
"modified": "2026-07-30T12:32:08Z",
"published": "2026-05-28T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46189"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46189.json"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a231c34c5bc3d3cfc850b877758ec9fdaa8a483"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/269967d7693304e1f06ed2dff4ebbbeeb397cda4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1df5711121cdc11e76b889408fdbe459feba1d39"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482588"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-46189"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40760"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40068"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38902"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36767"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36073"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:35904"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33743"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33685"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30848"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Choose a language that provides automatic memory management.
Mitigation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
Mitigation
Use a static analysis tool to find double free instances.
No CAPEC attack patterns related to this CWE.