Fallos del tipo CWE-401

750 resultados

Vazamento de memória por falta de liberação

Ocorre quando o código aloca memória (heap, buffer ou outros recursos) mas nunca a libera adequadamente, mesmo após seu uso terminar. A memória fica presa e indisponível, consumindo recursos até o programa encerrar ou falhar. É especialmente crítico em serviços de longa execução (daemons, servidores) onde o vazamento se acumula.

Ejemplo

Um servidor web que cria um objeto para processar cada requisição, mas esquece de desalocá-lo no final do tratamento. Após milhares de requisições, a memória disponível se esgota e o serviço cai. Ou código em C que chama malloc() mas nunca free(), deixando a memória órfã.

Cómo mitigar

Use garbage collection ou linguagens gerenciadas quando possível; em C/C++, aplique padrões como RAII (Resource Acquisition Is Initialization) ou smart pointers; faça code review focado em pares alloc/free; use ferramentas como Valgrind ou AddressSanitizer para detectar vazamentos antes da produção.

CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2024-24149MEDIUMA memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF fileEPSS 0.8%CVE-2024-24150MEDIUMA memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF fileEPSS 0.8%CVE-2026-93436HIGHvLLM through 0.29.0 Memory Exhaustion via Rejected RequestsEPSS 0.8%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.8%CVE-2024-8376HIGHMemory leakEPSS 0.7%CVE-2024-24147MEDIUMA memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF EPSS 0.7%CVE-2022-41624HIGHBIG-IP iRules vulnerability CVE-2022-41624EPSS 0.7%CVE-2022-41832HIGHBIG-IP SIP vulnerability CVE-2022-41832EPSS 0.7%CVE-2019-5023MEDIUMAn exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9EPSS 0.7%CVE-2024-27508HIGHAtheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.EPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.7%CVE-2025-20225MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive SecuEPSS 0.7%CVE-2025-20224MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.7%CVE-2025-0241HIGHMemory corruption when using JavaScript Text SegmentationEPSS 0.7%CVE-2023-30637HIGHBaidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server. NOTE: installations with brpc-0.14.0EPSS 0.7%CVE-2022-43032MEDIUMAn issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescripEPSS 0.7%CVE-2026-90784MEDIUMDvidelabs flatcc semantics.c fb_clear_parser memory leakEPSS 0.7%CVE-2022-23578MEDIUMMemory leak in TensorflowEPSS 0.7%