Weaknesses of type CWE-672

64 results

Operação em recurso após expiração ou liberação

Ocorre quando o código tenta usar um recurso (conexão de banco, arquivo, memória, token de autenticação) depois que ele foi expirado, fechado ou liberado. O programa não valida se o recurso está ainda válido antes de operar sobre ele, causando comportamento indefinido, vazamento de dados ou corrupção de estado.

Example

Uma aplicação obtém um token JWT com tempo de expiração, armazena em cache, mas continua usando o mesmo token horas depois sem verificar se expirou. Um atacante consegue reutilizar o token para acessar a API como outro usuário, ou uma conexão de banco é fechada mas o código tenta executar uma query nela, gerando erro ou acesso indevido.

How to mitigate

Sempre valide a vigência/estado do recurso antes de usá-lo (verificar timestamp de expiração, testar se conexão está ativa, checar se handle ainda é válido). Implemente mecanismo de renovação automática ou rejeição explícita de recursos expirados no ponto de uso.

CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2026-19538HIGHBypass of BLOCKED ACL items on proxy protocol port over TCP or TLSEPSS 0.3%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.3%CVE-2024-23332MEDIUMClient configured with permissive trust policies susceptible to rollback attack in Notary ProjectEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2025-69415HIGHIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2026-47087LOWAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted EPSS 0.3%CVE-2026-30978HIGHHeap-use-after-free in CIccCmm::AddXform()EPSS 0.3%CVE-2026-44725MEDIUMEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionEPSS 0.3%CVE-2026-61699HIGHnebula-mesh: Certificate revocation is never enforced at the meshEPSS 0.2%CVE-2026-33463MEDIUMOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-85044MEDIUMUse of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineeEPSS 0.2%CVE-2026-2379HIGHArista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is DisabledEPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2025-31253HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a EPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%CVE-2024-56674MEDIUMvirtio_net: correct netdev_tx_reset_queue() invocation pointEPSS 0.2%CVE-2026-42955LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsEPSS 0.2%