Fallos del tipo CWE-401

750 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2024-0240MEDIUMSilicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clientsEPSS 0.4%CVE-2026-3650HIGHGrassroots DICOM Missing release of memory after effective lifetimeEPSS 0.4%CVE-2024-42649MEDIUMNanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH messEPSS 0.4%CVE-2026-33856HIGHMissing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7EPSS 0.4%CVE-2026-20015MEDIUMA vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remEPSS 0.4%CVE-2026-20013MEDIUMA vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, remEPSS 0.4%CVE-2020-25704—A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local useEPSS 0.4%CVE-2026-61871MEDIUMImageMagick before 7.1.2-26 Memory Leak in ICON decoderEPSS 0.4%CVE-2023-2602—A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_creEPSS 0.4%CVE-2023-33719MEDIUMmp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cppEPSS 0.3%CVE-2025-29483MEDIUMlibming v0.4.8 was discovered to contain a memory leak via the parseSWF_ENABLEDEBUGGER2 function.EPSS 0.3%CVE-2026-0646HIGHRockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple VulnerabilitiesEPSS 0.3%CVE-2026-34052MEDIUMLTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)EPSS 0.3%CVE-2022-3633LOWLinux Kernel transport.c j1939_session_destroy memory leakEPSS 0.3%CVE-2025-47279LOWundici Denial of Service attack via bad certificate dataEPSS 0.3%CVE-2022-35894MEDIUMAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted EPSS 0.3%CVE-2025-43816MEDIUMA memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and LifeEPSS 0.3%CVE-2026-20014HIGHA vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remotEPSS 0.3%CVE-2025-56353HIGHIn tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs due to the broker's failure to validate or reEPSS 0.3%CVE-2026-14696MEDIUMEthernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustionEPSS 0.3%