Weaknesses of type CWE-672

81 results

Operação em recurso após expiração ou liberação

Ocorre quando o código tenta usar um recurso (conexão de banco, arquivo, memória, token de autenticação) depois que ele foi expirado, fechado ou liberado. O programa não valida se o recurso está ainda válido antes de operar sobre ele, causando comportamento indefinido, vazamento de dados ou corrupção de estado.

Example

Uma aplicação obtém um token JWT com tempo de expiração, armazena em cache, mas continua usando o mesmo token horas depois sem verificar se expirou. Um atacante consegue reutilizar o token para acessar a API como outro usuário, ou uma conexão de banco é fechada mas o código tenta executar uma query nela, gerando erro ou acesso indevido.

How to mitigate

Sempre valide a vigência/estado do recurso antes de usá-lo (verificar timestamp de expiração, testar se conexão está ativa, checar se handle ainda é válido). Implemente mecanismo de renovação automática ou rejeição explícita de recursos expirados no ponto de uso.

CVE-2025-30351LOWSuspended Directus user can continue to use session token to access APIEPSS 0.4%CVE-2026-44725MEDIUMEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionEPSS 0.4%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.4%CVE-2024-25619LOWDestroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonEPSS 0.4%CVE-2026-113121HIGHUse of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enEPSS 0.4%CVE-2013-10075CRITICALApache::Session versions through 1.94 for Perl re-creates deleted sessionsEPSS 0.4%CVE-2026-113216HIGHUse of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2024-4693MEDIUMQemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashEPSS 0.3%CVE-2026-42791MEDIUMOCSP responder certificate validity period not checked in public_keyEPSS 0.3%CVE-2026-30978HIGHHeap-use-after-free in CIccCmm::AddXform()EPSS 0.3%CVE-2026-85044MEDIUMUse of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineeEPSS 0.3%CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2026-93006MEDIUMDnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentEPSS 0.3%CVE-2026-121256HIGHUse of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%CVE-2024-23332MEDIUMClient configured with permissive trust policies susceptible to rollback attack in Notary ProjectEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2026-47087LOWAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted EPSS 0.3%CVE-2025-69415HIGHIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2026-79010MEDIUMOperation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comEPSS 0.3%