Fallos del tipo CWE-401

619 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2022-20785HIGHClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022EPSS 7.0%CVE-2022-47941HIGHAn issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_EPSS 4.9%CVE-2025-53020HIGHApache HTTP Server: HTTP/2 DoS by Memory IncreaseEPSS 4.6%CVE-2019-20388HIGHxmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.EPSS 4.3%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%CVE-2022-1012—A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flawEPSS 3.9%CVE-2017-15094—An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when pEPSS 3.3%CVE-2020-25672—A memory leak vulnerability was found in Linux kernel in llcp_sock_connectEPSS 3.1%CVE-2019-14818HIGHA flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a EPSS 2.8%CVE-2022-38177HIGHMemory leak in ECDSA DNSSEC verification codeEPSS 2.6%CVE-2022-38178HIGHMemory leaks in EdDSA DNSSEC verification codeEPSS 2.5%CVE-2020-25644—A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attackeEPSS 2.4%CVE-2020-35502—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy iEPSS 2.4%CVE-2021-20210—A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can leEPSS 2.4%CVE-2021-20215—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to EPSS 2.3%CVE-2017-7654—In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can sendEPSS 2.2%CVE-2021-20211—A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.EPSS 2.1%CVE-2021-20214—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memorEPSS 2.0%CVE-2021-20212—A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcrEPSS 2.0%CVE-2022-24756HIGHMissing Release of Memory after Effective Lifetime in Bareos DirectorEPSS 1.9%