Weaknesses of type CWE-772

89 results

Vazamento de recurso após fim de sua vida útil

Ocorre quando um programa aloca um recurso (memória, arquivo, conexão de banco de dados, socket) mas não o libera quando termina de usá-lo. O recurso fica ocupado indefinidamente, consumindo memória ou esgotando limites do sistema, levando a degradação de performance ou indisponibilidade da aplicação.

Example

Uma função abre uma conexão com banco de dados para buscar dados, mas nunca fecha a conexão após usar. Em uma aplicação web com múltiplas requisições, isso drena o pool de conexões até que novas requisições falham com 'too many connections'.

How to mitigate

Use sempre blocos try-finally ou estruturas de gerenciamento automático (como 'with' em Python, 'using' em C#) para garantir que recursos sejam liberados mesmo em caso de exceção. Em código legado, aplique code review focado em recursos não fechados e estabeleça padrões de cleanup obrigatórios.

CVE-2024-20481MEDIUMA vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeEPSS 15.9%KEVCVE-2021-42340—DoS via memory leak with WebSocket connectionsEPSS 11.8%CVE-2019-3883MEDIUMIn 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocEPSS 8.4%CVE-2019-19956HIGHxmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.EPSS 5.5%CVE-2019-3821HIGHA flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could EPSS 2.9%CVE-2018-20622MEDIUMJasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used.EPSS 2.9%CVE-2022-26353—A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unEPSS 2.7%CVE-2024-49769HIGHWaitress has a denial of service leading to high CPU usage/resource exhaustionEPSS 1.4%CVE-2021-1523HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service VulnerabilityEPSS 1.3%CVE-2022-29884—A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/EPSS 1.2%CVE-2024-41888MEDIUMApache Answer: The link for resetting user password is not Single-UseEPSS 1.2%CVE-2024-41890MEDIUMApache Answer: The link to reset the user's password will remain valid after sending a new linkEPSS 1.1%CVE-2024-1300MEDIUMIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportEPSS 1.1%CVE-2021-34581HIGHWAGO: Denial of Service vulnerability inside the OpenSSL implementationEPSS 1.0%CVE-2021-31378MEDIUMJunos OS: An attacker sending spoofed RADIUS messages to a Junos OS device configured for broadband services may cause broadband subscribers to remain stuck in a "Terminating" state.EPSS 1.0%CVE-2021-21002HIGHDenial of Service in Phoenix Contact FL COMSERVER UNI productsEPSS 1.0%CVE-2023-1150HIGHWAGO: Series 750-3x/-8x prone to MODBUS server DoSEPSS 0.9%CVE-2022-22170HIGHJunos OS: Specific packets over VXLAN cause FPC memory leak and ultimately resetEPSS 0.9%CVE-2025-24120HIGHThis issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VEPSS 0.9%CVE-2021-21600MEDIUMDell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentEPSS 0.8%