Weaknesses of type CWE-772

107 results

Vazamento de recurso após fim de sua vida útil

Ocorre quando um programa aloca um recurso (memória, arquivo, conexão de banco de dados, socket) mas não o libera quando termina de usá-lo. O recurso fica ocupado indefinidamente, consumindo memória ou esgotando limites do sistema, levando a degradação de performance ou indisponibilidade da aplicação.

Example

Uma função abre uma conexão com banco de dados para buscar dados, mas nunca fecha a conexão após usar. Em uma aplicação web com múltiplas requisições, isso drena o pool de conexões até que novas requisições falham com 'too many connections'.

How to mitigate

Use sempre blocos try-finally ou estruturas de gerenciamento automático (como 'with' em Python, 'using' em C#) para garantir que recursos sejam liberados mesmo em caso de exceção. Em código legado, aplique code review focado em recursos não fechados e estabeleça padrões de cleanup obrigatórios.

CVE-2021-21600MEDIUMDell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentEPSS 0.8%CVE-2023-36533HIGHUncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network accEPSS 0.8%CVE-2023-47124MEDIUMDenial of service whith ACME HTTPChallenge in TraefikEPSS 0.8%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.8%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.7%CVE-2026-3104HIGHMemory leak in code preparing DNSSEC proofs of non-existenceEPSS 0.7%CVE-2026-69664HIGHhttpd parks a request worker indefinitely on a malformed chunk size sent after the headersEPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2024-28882MEDIUMOpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the valiEPSS 0.7%CVE-2026-2359HIGHMulter vulnerable to Denial of Service via resource exhaustionEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2023-20095HIGHA vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDEPSS 0.6%CVE-2026-39830CRITICALInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshEPSS 0.6%CVE-2024-52303HIGHaiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodEPSS 0.6%CVE-2026-36590HIGHAn issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componEPSS 0.6%CVE-2024-35821HIGHubifs: Set page uptodate in the correct placeEPSS 0.6%CVE-2026-15713MEDIUMLibsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leakEPSS 0.6%CVE-2026-21874MEDIUMNiceGUI has Redis connection leak via tab storage causes service degradationEPSS 0.6%CVE-2024-10396MEDIUMFileserver crash and possible information leak on StoreACL/FetchACLEPSS 0.6%CVE-2026-20250HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service VulnerabilityEPSS 0.5%