Fallos del tipo CWE-401

664 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2026-67183HIGHTinyWeb 0.0.8 Memory Leak DoS via HTTP Request HandlingEPSS 0.4%CVE-2025-56226MEDIUMLibsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.EPSS 0.4%CVE-2026-87776HIGHcompression vulnerable to Denial of Service via memory leak on premature response closeEPSS 0.4%CVE-2021-34740HIGHCisco Aironet Access Points WLAN Control Protocol Packet Buffer Leak Denial of Service VulnerabilityEPSS 0.4%CVE-2024-0240MEDIUMSilicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clientsEPSS 0.4%CVE-2026-25969MEDIUMImageMagick has Memory Leak in coders/ashlar.cEPSS 0.4%CVE-2024-9135MEDIUMOn affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.EPSS 0.4%CVE-2026-76235HIGHCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlEPSS 0.4%CVE-2026-20012HIGHA vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall AEPSS 0.4%CVE-2026-78127LOWlibcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.EPSS 0.4%CVE-2020-25704—A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local useEPSS 0.4%CVE-2026-3650HIGHGrassroots DICOM Missing release of memory after effective lifetimeEPSS 0.4%CVE-2026-61871MEDIUMImageMagick before 7.1.2-26 Memory Leak in ICON decoderEPSS 0.4%CVE-2023-2602—A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_creEPSS 0.4%CVE-2026-67437HIGHOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)EPSS 0.4%CVE-2026-33856HIGHMissing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7EPSS 0.3%CVE-2023-33719MEDIUMmp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cppEPSS 0.3%CVE-2026-0646HIGHRockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple VulnerabilitiesEPSS 0.3%CVE-2022-3629LOWLinux Kernel af_vsock.c vsock_connect memory leakEPSS 0.3%CVE-2025-43816MEDIUMA memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and LifeEPSS 0.3%