Common Weakness Enumeration

    CWE Definition / CWE-226

    CWE-226: Sensitive Information in Resource Not Removed Before Reuse

    The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or zeroize the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:9 Sep 2025

    Related Weakness

    CWE-459: Incomplete Cleanup

    CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

    CWE-201: Insertion of Sensitive Information Into Sent Data