Weaknesses of type CWE-404

693 results

Liberação ou encerramento impróprio de recursos

Acontece quando a aplicação não libera adequadamente recursos (memória, conexões de banco de dados, arquivos abertos, sockets) após seu uso, deixando-os presos. Isso causa vazamento de recursos: a aplicação consome cada vez mais memória ou conexões até ficar indisponível ou travar.

Example

Um serviço web abre uma conexão com o banco de dados para cada requisição, mas em caso de erro não fecha a conexão no bloco finally ou com try-with-resources. Após milhares de requisições falhadas, o pool de conexões se esgota e novas requisições começam a falhar.

How to mitigate

Use try-with-resources (Java), context managers (Python), ou finally blocks para garantir liberação mesmo em caso de exceção. Implemente testes de carga e monitore vazamento de recursos em produção com ferramentas APM.

CVE-2023-1444HIGHFilseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of serviceEPSS 1.3%CVE-2024-22025MEDIUMA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetEPSS 1.3%CVE-2024-0261MEDIUMSentex FTPDMIN RNFR Command denial of serviceEPSS 1.3%CVE-2024-0693MEDIUMEFS Easy File Sharing FTP denial of serviceEPSS 1.3%CVE-2023-2380MEDIUMNetgear SRX5308 denial of serviceEPSS 1.3%CVE-2023-7209HIGHUniway Router Device Reset device_reset.cgi denial of serviceEPSS 1.3%CVE-2023-2379HIGHUbiquiti EdgeRouter X Web Service denial of serviceEPSS 1.3%CVE-2013-1055MEDIUMPotential DoS through abuse of rate limit in libunity-webapps for FirefoxEPSS 1.3%CVE-2024-11650HIGHTenda i9 GetIPTV websReadEvent null pointer dereferenceEPSS 1.3%CVE-2024-4791HIGHContemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of serviceEPSS 1.3%CVE-2021-4433MEDIUMKarjasoft Sami HTTP Server HTTP HEAD Rrequest denial of serviceEPSS 1.3%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2025-5867HIGHRT-Thread lwp_syscall.c csys_sendto null pointer dereferenceEPSS 1.2%CVE-2023-2789LOWGNU cflow parser.c parse_variable_declaration denial of serviceEPSS 1.2%CVE-2019-0028HIGHJunos OS: RPD process crashes due to specific BGP peer restarts condition.EPSS 1.2%CVE-2020-14307MEDIUMA vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations aEPSS 1.2%CVE-2017-20024MEDIUMSolare Solar-Log denial of serviceEPSS 1.2%CVE-2019-25104LOWrtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of serviceEPSS 1.2%CVE-2023-29726HIGHThe Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty dEPSS 1.2%CVE-2025-61795MEDIUMApache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSEPSS 1.2%