Weaknesses of type CWE-672

81 results

Operação em recurso após expiração ou liberação

Ocorre quando o código tenta usar um recurso (conexão de banco, arquivo, memória, token de autenticação) depois que ele foi expirado, fechado ou liberado. O programa não valida se o recurso está ainda válido antes de operar sobre ele, causando comportamento indefinido, vazamento de dados ou corrupção de estado.

Example

Uma aplicação obtém um token JWT com tempo de expiração, armazena em cache, mas continua usando o mesmo token horas depois sem verificar se expirou. Um atacante consegue reutilizar o token para acessar a API como outro usuário, ou uma conexão de banco é fechada mas o código tenta executar uma query nela, gerando erro ou acesso indevido.

How to mitigate

Sempre valide a vigência/estado do recurso antes de usá-lo (verificar timestamp de expiração, testar se conexão está ativa, checar se handle ainda é válido). Implemente mecanismo de renovação automática ou rejeição explícita de recursos expirados no ponto de uso.

CVE-2026-72108HIGHdm thin metadata: fix metadata snapshot consistency on commit failureEPSS 0.3%CVE-2026-96589MEDIUMGitea private repository access retained after rejected transferEPSS 0.2%CVE-2026-33463MEDIUMOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%CVE-2026-106310MEDIUMUse of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-2379HIGHArista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is DisabledEPSS 0.2%CVE-2026-95366MEDIUMUse of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2025-31253HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a EPSS 0.2%CVE-2026-106345MEDIUMUse of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2025-39698HIGHio_uring/futex: ensure io_futex_wait() cleans up properly on failureEPSS 0.2%CVE-2024-56674MEDIUMvirtio_net: correct netdev_tx_reset_queue() invocation pointEPSS 0.2%CVE-2026-42955LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsEPSS 0.2%CVE-2026-106339LOWUse of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-106320MEDIUMUse of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process toEPSS 0.2%CVE-2026-4053LOWpost edit time limit is not enforced on some post update operationsEPSS 0.2%CVE-2025-21117MEDIUMDell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentialEPSS 0.2%CVE-2026-1237LOWVulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upEPSS 0.1%CVE-2026-115402MEDIUMOpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition iEPSS 0.1%