CWE-568 is a Java weakness: a class defines finalize() but does not call super.finalize(). The Java Language Specification calls it good practice for a finalize() method to do so.
If a parent class releases resources in its own finalizer, skipping the call means that cleanup never happens. Finalizers are also deprecated in modern Java, but plenty of older code still uses them.
How it happens
MITRE's example:
// Vulnerable
protected void finalize() {
discardNative();
}
The subclass cleans up its own native resource and forgets the parent. Anything the superclass held, such as handles, buffers or locks, stays allocated until the process ends.
What an attacker gains
MITRE lists quality degradation only. The indirect risk is a resource leak that someone can trigger repeatedly to exhaust memory or handles.
How to find it
Automated static analysis can find some instances, per MITRE. A search for void finalize without super.finalize nearby finds the rest.
How to fix it
MITRE's mitigation: call super.finalize().
// Fixed: finally ensures the parent always runs
protected void finalize() throws Throwable {
try {
discardNative();
} finally {
super.finalize();
}
}
Better still, move to try with resources and AutoCloseable, or java.lang.ref.Cleaner, and retire finalizers.
Quick check
Why call super.finalize()?
So the parent class can release whatever it holds. Skipping it leaves that cleanup undone.
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
