Public Finalize Override

ID

java.object_finalize_remain_protected_versus

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Code Smell

Language

Java

Tags

CWE:583, best-practice, reliability

Description

Reports a finalize() override declared public.

Rationale

Object.finalize() is protected, and only the garbage collector is meant to call it. Declaring the override public advertises the method as something callers can invoke directly, which is misleading: calling finalize() yourself does not free anything a caller expects, and running it twice can corrupt state that assumes it runs exactly once.

// Bad - looks like a public API method, but only the GC should call it
public class NativeHandle {
    @Override
    public void finalize() throws Throwable {
        release();
    }
}

Remediation

Keep the override at protected, matching the visibility of Object.finalize().

// Good
public class NativeHandle {
    @Override
    protected void finalize() throws Throwable {
        release();
    }
}

References

© 2026 Xygeni. All rights reserved