Weaknesses of type CWE-664

64 results

Controle inadequado de recurso durante seu ciclo de vida

Ocorre quando o software não gerencia corretamente a alocação, uso e liberação de um recurso (memória, arquivo, conexão de banco de dados, handle). Isso permite que o recurso seja acessado após ser liberado, reutilizado de forma insegura, ou nunca liberado, causando vazamentos ou corrupção de estado.

Example

Uma aplicação web abre uma conexão com banco de dados em uma thread, mas não a fecha em caso de exceção. A conexão fica aberta indefinidamente, exaurindo o pool de conexões. Ou um buffer é liberado, mas o código continua escrevendo nele em outra parte da aplicação, causando corrupção de memória.

How to mitigate

Use padrões como try-finally, try-with-resources (Java) ou context managers (Python) para garantir liberação automática. Implemente análise estática para detectar vazamentos. Revise o fluxo de controle (exceções, retornos antecipados) e documente claramente quem é responsável por liberar cada recurso.

CVE-2022-27518CRITICALUnauthenticated remote arbitrary code executionEPSS 6.9%KEVCVE-2022-2048HIGHIn Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noEPSS 2.6%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.2%CVE-2026-43503HIGHnet: skbuff: propagate shared-frag marker through frag-transfer helpersEPSS 2.0%CVE-2020-3175HIGHCisco MDS 9000 Series Multilayer Switches Denial of Service VulnerabilityEPSS 2.0%CVE-2019-16779MEDIUMIn RubyGem excon, interrupted Persistent Connections May Leak Response DataEPSS 1.7%CVE-2024-45383MEDIUMA mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36EPSS 1.5%CVE-2022-31153MEDIUMOpenZeppelin Contracts for Cairo account cannot process transactions on GoerliEPSS 1.5%CVE-2022-20748MEDIUMCisco Firepower Threat Defense Software Local Malware Analysis Denial of Service VulnerabilityEPSS 1.3%CVE-2022-20856HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service VulnerabilityEPSS 1.3%CVE-2021-1592MEDIUMCisco UCS Manager Software SSH Sessions Denial of Service VulnerabilityEPSS 1.0%CVE-2022-27512—Temporary disruption of the ADM license serviceEPSS 1.0%CVE-2022-46144HIGHA vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) EPSS 0.9%CVE-2022-1385LOWInvitation Email is resent as a Reminder after invalidating pending email invitesEPSS 0.8%CVE-2026-72041CRITICALespintcp: use sk_msg_free_partial to fix partial sendEPSS 0.7%CVE-2023-44288HIGH Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthentEPSS 0.7%CVE-2024-41169HIGHApache Zeppelin: raft directory listing and file readEPSS 0.7%CVE-2025-34226HIGHOpenPLC Runtime v3 Persistent DoSEPSS 0.7%CVE-2022-32846HIGHA logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to accEPSS 0.6%CVE-2023-25942MEDIUM Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low prEPSS 0.6%