Fallos del tipo CWE-401

664 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2024-39549HIGHJunos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to a memory leakEPSS 0.5%CVE-2024-5294MEDIUMD-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service VulnerabilityEPSS 0.5%CVE-2025-61974HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.5%CVE-2024-50170HIGHnet: bcmasp: fix potential memory leak in bcmasp_xmit()EPSS 0.5%CVE-2026-21714MEDIUMA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cEPSS 0.5%CVE-2025-21091HIGHBIG-IP SNMP vulnerabilityEPSS 0.5%CVE-2026-94627HIGHvLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID CollisionEPSS 0.4%CVE-2026-56819HIGHNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)EPSS 0.4%CVE-2024-7708HIGHFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case forEPSS 0.4%CVE-2026-63448MEDIUMSuricata smb: some SMB flows can cause resource exhaustionEPSS 0.4%CVE-2026-25988MEDIUMImageMagick's MSL image stack index not refreshed, leading to leaked images.EPSS 0.4%CVE-2024-26462MEDIUMKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.EPSS 0.4%CVE-2021-3544—Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They existEPSS 0.4%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.4%CVE-2019-20386MEDIUMAn issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory EPSS 0.4%CVE-2021-0272MEDIUMJunos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC.EPSS 0.4%CVE-2026-63252HIGHIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel EPSS 0.4%CVE-2026-44660HIGHUltraJSON: Memory Leak in ujson.dump() on Write FailureEPSS 0.4%CVE-2026-48141MEDIUMMemory leak in NI grpc-device BeginSidebandStreamEPSS 0.4%CVE-2025-53537HIGHLibHTP's memory leak with lzma can lead to resource starvationEPSS 0.4%