Explicit Call to Finalize()

This vulnerability occurs when code directly calls an object's finalize() method from outside its designated finalizer context.

Although the Java language specification technically permits calling an object's finalize() method explicitly, this practice is strongly discouraged and often leads to unexpected behavior. The primary issue is that it forces the finalization routine to execute prematurely, outside the control of the garbage collector, which can corrupt the object's state and break standard cleanup logic. Explicitly invoking finalize() typically causes the method to run multiple times: once during the manual call and again later when the garbage collector naturally disposes of the object. This double execution can trigger resource leaks, double-free errors, or other instability because cleanup code is not designed to be idempotent. Developers should rely on the garbage collector to manage finalization automatically and use try-with-resources or explicit close() methods for deterministic cleanup instead.