Fallos del tipo CWE-401

750 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2021-20214—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memorEPSS 2.0%CVE-2021-33645—The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.EPSS 2.0%CVE-2021-33646—The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.EPSS 2.0%CVE-2022-24756HIGHMissing Release of Memory after Effective Lifetime in Bareos DirectorEPSS 1.9%CVE-2021-20209—A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.EPSS 1.9%CVE-2021-39176HIGHMissing Release of Memory after Effective Lifetime in detect-character-encodingEPSS 1.9%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2021-27386HIGHA vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 UpdatEPSS 1.8%CVE-2021-4213—A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturatiEPSS 1.7%CVE-2022-2963HIGHA vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause aEPSS 1.7%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2021-37205HIGHA vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CEPSS 1.6%CVE-2024-24267HIGHgpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.EPSS 1.6%CVE-2023-5156HIGHGlibc: dos due to memory leak in getaddrinfo.cEPSS 1.6%CVE-2019-6129MEDIUMpng_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think EPSS 1.6%CVE-2021-3492HIGHUbuntu linux kernel shiftfs file system double free vulnerabilityEPSS 1.5%CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2020-25689MEDIUMA memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating nEPSS 1.5%CVE-2025-25199HIGHBCryptGenerateSymmetricKey memory leakEPSS 1.4%CVE-2021-44541—A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get theEPSS 1.4%