Fallos del tipo CWE-404
748 resultadosLiberação ou encerramento inadequado de recursos
Quando o software não libera corretamente recursos (conexões de banco, arquivo aberto, memória alocada, socket de rede) após o uso. O programa continua consumindo esses recursos até ficar sem espaço ou conexões disponíveis, causando falhas, lentidão ou negação de serviço.
Ejemplo
Um servidor web abre uma conexão com banco de dados para cada requisição, mas esquece de fechar a conexão quando termina. Após centenas de requisições, todas as conexões disponíveis estão esgotadas e novas requisições falham.
Cómo mitigar
Use padrões como try-with-resources (Java), context managers (Python), ou equivalentes na sua linguagem para garantir liberação automática. Implemente timeouts e monitore uso de recursos em produção para detectar vazamentos cedo.
CVE-2018-8406HIGHAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "EPSS 3.4%KEVCVE-2023-45802—Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTEPSS 3.2%CVE-2024-22019HIGHA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resourEPSS 3.2%CVE-2022-3594MEDIUMLinux Kernel BPF r8152.c intr_callback logging of excessive dataEPSS 3.1%CVE-2024-39721HIGHAn issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path EPSS 2.7%CVE-2022-3551LOWX.org Server xkb.c ProcXkbGetKbdByName memory leakEPSS 2.4%CVE-2025-9784HIGHUndertow: undertow madeyoureset http/2 ddos vulnerabilityEPSS 2.3%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.2%CVE-2019-1708HIGHCisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software MOBIKE Denial of Service VulnerabilityEPSS 2.1%CVE-2019-1705MEDIUMCisco Adaptive Security Appliance Software VPN Denial of Service VulnerabilityEPSS 2.0%CVE-2025-0492HIGHD-Link DIR-823X FUN_00412244 null pointer dereferenceEPSS 2.0%CVE-2025-4756MEDIUMD-Link DI-7003GV2 restart.asp denial of serviceEPSS 2.0%CVE-2020-26070HIGHCisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service VulnerabilityEPSS 1.9%CVE-2020-16233—An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data fEPSS 1.8%CVE-2019-0052HIGHSRX Series: srxpfe process crash while JSF/UTM module parses specific HTTP packetsEPSS 1.8%CVE-2025-8175HIGHD-Link DI-8400 jhttpd usb_paswd.asp null pointer dereferenceEPSS 1.8%CVE-2022-33324HIGHDenial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC SeriesEPSS 1.8%CVE-2020-3338HIGHCisco NX-OS Software IPv6 Protocol Independent Multicast Denial of Service VulnerabilityEPSS 1.8%CVE-2022-3621MEDIUMLinux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereferenceEPSS 1.7%CVE-2020-3555MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SIP Denial of Service VulnerabilityEPSS 1.7%