Fallos del tipo CWE-401

664 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2021-44541—A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get theEPSS 1.4%CVE-2025-23085MEDIUMA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid hEPSS 1.4%CVE-2019-6129MEDIUMpng_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think EPSS 1.4%CVE-2023-5156HIGHGlibc: dos due to memory leak in getaddrinfo.cEPSS 1.3%CVE-2024-24265HIGHgpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.EPSS 1.3%CVE-2023-28366HIGHThe broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2EPSS 1.3%CVE-2021-44540—A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.EPSS 1.3%CVE-2023-2618MEDIUMOpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeHanziSegment memory leakEPSS 1.3%CVE-2021-1353MEDIUMCisco StarOS IPv4 Denial of Service VulnerabilityEPSS 1.3%CVE-2022-4743HIGHA potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attaEPSS 1.3%CVE-2025-29828HIGHWindows Schannel Remote Code Execution VulnerabilityEPSS 1.3%CVE-2023-26083LOWMemory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver aEPSS 1.2%KEVCVE-2023-26257HIGHAn issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is notEPSS 1.2%CVE-2024-41172MEDIUMApache CXF: Unrestricted memory consumption in CXF HTTP clientsEPSS 1.2%CVE-2026-35424HIGHInternet Key Exchange (IKE) Protocol Denial of Service VulnerabilityEPSS 1.2%CVE-2021-44542—A memory leak vulnerability was found in Privoxy when handling errors.EPSS 1.2%CVE-2026-44806MEDIUMWindows Secure Channel Denial of Service VulnerabilityEPSS 1.2%CVE-2026-69588HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 1.2%CVE-2026-70065HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.2%CVE-2021-46854HIGHmod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.EPSS 1.2%