Weaknesses of type CWE-404

748 results

Liberação ou encerramento impróprio de recursos

Acontece quando a aplicação não libera adequadamente recursos (memória, conexões de banco de dados, arquivos abertos, sockets) após seu uso, deixando-os presos. Isso causa vazamento de recursos: a aplicação consome cada vez mais memória ou conexões até ficar indisponível ou travar.

Example

Um serviço web abre uma conexão com o banco de dados para cada requisição, mas em caso de erro não fecha a conexão no bloco finally ou com try-with-resources. Após milhares de requisições falhadas, o pool de conexões se esgota e novas requisições começam a falhar.

How to mitigate

Use try-with-resources (Java), context managers (Python), ou finally blocks para garantir liberação mesmo em caso de exceção. Implemente testes de carga e monitore vazamento de recursos em produção com ferramentas APM.

CVE-2019-25104LOWrtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of serviceEPSS 1.2%CVE-2022-3526MEDIUMLinux Kernel skb macvlan.c macvlan_handle_frame memory leakEPSS 1.2%CVE-2023-24444CRITICALJenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.EPSS 1.2%CVE-2021-4250LOWcgriego active_attr Regex boolean_typecaster.rb call denial of serviceEPSS 1.2%CVE-2023-29726HIGHThe Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty dEPSS 1.2%CVE-2022-4066LOWdavidmoreno onion Log response.c onion_response_flush allocation of resourcesEPSS 1.2%CVE-2022-1289MEDIUMtildearrow Furnace Incomplete Fix CVE-2022-1211 denial of serviceEPSS 1.2%CVE-2023-5259LOWForU CMS cms_admin.php denial of serviceEPSS 1.1%CVE-2024-0419MEDIUMJasper httpdx HTTP POST Request denial of serviceEPSS 1.1%CVE-2019-0019HIGHBGP packets can trigger rpd crash when BGP tracing is enabled.EPSS 1.1%CVE-2024-0887MEDIUMMafiatic Blue Server Connection denial of serviceEPSS 1.1%CVE-2022-3817MEDIUMAxiomatic Bento4 mp4mux memory leakEPSS 1.1%CVE-2024-0731MEDIUMPCMan FTP Server PUT Command denial of serviceEPSS 1.1%CVE-2024-0732MEDIUMPCMan FTP Server STOR Command denial of serviceEPSS 1.1%CVE-2021-27458—If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCEPSS 1.1%CVE-2022-3353MEDIUMIEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy ProductsEPSS 1.1%CVE-2023-5462MEDIUMXINJE XD5E-30R-E Modbus denial of serviceEPSS 1.1%CVE-2024-0888MEDIUMBORGChat Service Port 7551 denial of serviceEPSS 1.1%CVE-2024-20966MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 1.1%CVE-2022-3524MEDIUMLinux Kernel IPv6 ipv6_renew_options memory leakEPSS 1.1%