Fallos del tipo CWE-404
748 resultadosLiberação ou encerramento inadequado de recursos
Quando o software não libera corretamente recursos (conexões de banco, arquivo aberto, memória alocada, socket de rede) após o uso. O programa continua consumindo esses recursos até ficar sem espaço ou conexões disponíveis, causando falhas, lentidão ou negação de serviço.
Ejemplo
Um servidor web abre uma conexão com banco de dados para cada requisição, mas esquece de fechar a conexão quando termina. Após centenas de requisições, todas as conexões disponíveis estão esgotadas e novas requisições falham.
Cómo mitigar
Use padrões como try-with-resources (Java), context managers (Python), ou equivalentes na sua linguagem para garantir liberação automática. Implemente timeouts e monitore uso de recursos em produção para detectar vazamentos cedo.
CVE-2026-10650MEDIUMwarmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumptionEPSS 0.4%CVE-2026-20050MEDIUMCisco Secure Firewall Threat Defense Decryption Policy Denial of Service VulnerabilityEPSS 0.4%CVE-2026-118275MEDIUMa2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumptionEPSS 0.4%CVE-2026-9540MEDIUMvllm-project vllm OpenAI-compatible Serving Path denial of serviceEPSS 0.4%CVE-2024-47213HIGHAn issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon recEPSS 0.4%CVE-2026-101040HIGHRicoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of serviceEPSS 0.4%CVE-2024-1191LOWHyper CdCatalog HCF File denial of serviceEPSS 0.4%CVE-2026-112083MEDIUMsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of serviceEPSS 0.4%CVE-2023-51332MEDIUMA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessivEPSS 0.4%CVE-2022-3533LOWLinux Kernel BPF usdt.c parse_usdt_arg memory leakEPSS 0.4%CVE-2025-69821HIGHAn issue in Beat XP VEGA Smartwatch (Firmware Version - RB303ATV006229) allows an attacker to cause a denial of service via the BLE connectiEPSS 0.4%CVE-2025-22846HIGHBIG-IP SIP VulnerabilityEPSS 0.4%CVE-2026-7707MEDIUMOpen5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of serviceEPSS 0.4%CVE-2026-120237MEDIUMag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumptionEPSS 0.4%CVE-2026-100895MEDIUMTrusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereferenceEPSS 0.4%CVE-2026-93312MEDIUMFreedesktop Poppler JBIG2Stream.cc rewind null pointer dereferenceEPSS 0.4%CVE-2025-29313HIGHUse of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attEPSS 0.4%CVE-2025-47148HIGHBIG-IP APM and SSL Orchestrator vulnerabilityEPSS 0.4%CVE-2025-13564MEDIUMSourceCodester Pre-School Management System FilehelperController.php removefile denial of serviceEPSS 0.4%CVE-2025-55102HIGHA denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network pEPSS 0.4%