Fallos del tipo CWE-401

661 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2024-27507HIGHlibLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.EPSS 1.2%CVE-2024-24258HIGHfreeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.EPSS 1.1%CVE-2024-24259HIGHfreeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.EPSS 1.1%CVE-2026-69497MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 1.1%CVE-2023-33460MEDIUMThere's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.EPSS 1.1%CVE-2020-27822—A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an applicationEPSS 1.1%CVE-2026-4247HIGHTCP: remotely exploitable DoS vector (mbuf leak)EPSS 1.1%CVE-2021-34431—In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to theEPSS 1.1%CVE-2023-25566HIGHGSS-NTLMSSP vulnerable to memory leak when parsing usernamesEPSS 1.1%CVE-2026-69809HIGHWindows Active Directory Domain Services Denial of Service VulnerabilityEPSS 1.1%CVE-2020-11637MEDIUMAutomation Runtime TFTP Service DoS VulnerabilityEPSS 1.1%CVE-2021-20193—A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to causeEPSS 1.1%CVE-2020-1683HIGHJunos OS: Memory leak leads to kernel crash (vmcore) due to SNMP pollingEPSS 1.1%CVE-2022-23585MEDIUMMemory leak in decoding PNG images in TensorflowEPSS 1.0%CVE-2022-22209HIGHJunos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churnEPSS 1.0%CVE-2023-38380HIGHA vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUEPSS 1.0%CVE-2023-6299MEDIUMApryse iText Reference Table PdfDocument.java memory leakEPSS 0.9%CVE-2021-34598HIGHPhoenix Contact: FL MGUARD lack of memory release in remote logging functionalityEPSS 0.9%CVE-2022-22174HIGHJunos OS: QFX5000 Series, EX4600: Device may run out of memory, causing traffic loss, upon receipt of specific IPv6 packetsEPSS 0.9%CVE-2021-23218MEDIUMMemory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of ServiceEPSS 0.9%