Weaknesses of type CWE-401

619 results

Vazamento de memória por falta de liberação

Ocorre quando o programa aloca memória (heap ou recursos) mas não a libera adequadamente após seu uso, deixando-a inacessível para reutilização. O memory leaker consome progressivamente mais RAM, degradando performance e podendo levar a negação de serviço, especialmente em aplicações de longa duração ou servidores.

Example

Um servidor web que cria um objeto para processar cada requisição mas esquece de chamar `free()` ou `delete` ao final. Depois de milhões de requisições, toda memória disponível está consumida por objetos orphans e o servidor para de responder.

How to mitigate

Use análise estática (static analyzers) ou ferramentas de profiling (valgrind, sanitizers do GCC/Clang) para detectar leaks em desenvolvimento. Em linguagens com garbage collection, garanta que objetos saiam de escopo corretamente; em C/C++, libere sempre o que alocou, ou prefira smart pointers (unique_ptr, shared_ptr) que liberam automaticamente.

CVE-2022-20785HIGHClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022EPSS 7.0%CVE-2022-47941HIGHAn issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_EPSS 4.9%CVE-2025-53020HIGHApache HTTP Server: HTTP/2 DoS by Memory IncreaseEPSS 4.6%CVE-2019-20388HIGHxmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.EPSS 4.3%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%CVE-2022-1012—A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flawEPSS 3.9%CVE-2017-15094—An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when pEPSS 3.3%CVE-2020-25672—A memory leak vulnerability was found in Linux kernel in llcp_sock_connectEPSS 3.1%CVE-2019-14818HIGHA flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a EPSS 2.8%CVE-2022-38177HIGHMemory leak in ECDSA DNSSEC verification codeEPSS 2.6%CVE-2022-38178HIGHMemory leaks in EdDSA DNSSEC verification codeEPSS 2.5%CVE-2020-25644—A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attackeEPSS 2.4%CVE-2020-35502—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy iEPSS 2.4%CVE-2021-20210—A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can leEPSS 2.4%CVE-2021-20215—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to EPSS 2.3%CVE-2017-7654—In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can sendEPSS 2.2%CVE-2021-20211—A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.EPSS 2.1%CVE-2021-20214—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memorEPSS 2.0%CVE-2021-20212—A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcrEPSS 2.0%CVE-2022-24756HIGHMissing Release of Memory after Effective Lifetime in Bareos DirectorEPSS 1.9%