Fallos del tipo CWE-664

64 resultados

Controle inadequado de recurso durante seu ciclo de vida

Fraqueza genérica onde o software falha em gerenciar corretamente um recurso (memória, arquivo, conexão, etc.) desde sua alocação até sua liberação. Sem aquisição, uso ou liberação adequados, o recurso pode vazar, ser acessado após ser destruído, ou ficar em estado inconsistente, abrindo brechas de segurança.

Ejemplo

Um aplicativo abre uma conexão com banco de dados dentro de um bloco try, mas não fecha a conexão em um finally ou try-with-resources. Se uma exceção for lançada, a conexão permanece aberta, esgotando o pool de conexões e causando negação de serviço; ou um ponteiro é desalocado mas o código continua tentando acessá-lo, gerando leitura/escrita em memória inválida.

Cómo mitigar

Use padrões de gerenciamento automático: try-with-resources (Java), context managers (Python), RAII (C++), ou garbage collection. Garanta aquisição em um ponto e liberação em outro bem definido. Para recursos críticos, implemente testes que validem ciclos de vida completos e ferramentas estáticas de análise que detectem leaks e acessos inválidos.

CVE-2026-18549HIGH@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limitEPSS 0.6%CVE-2022-28287MEDIUMIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability afEPSS 0.6%CVE-2026-20274CRITICALCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.5%CVE-2026-20353CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%CVE-2026-54251HIGHnetty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of ServiceEPSS 0.5%CVE-2026-8517HIGHObject lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage EPSS 0.5%CVE-2022-22249MEDIUMJunos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domainEPSS 0.5%CVE-2026-57187HIGHAsterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processingEPSS 0.5%CVE-2024-37139MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through itsEPSS 0.5%CVE-2026-43158HIGHxfs: fix freemap adjustments when adding xattrs to leaf blocksEPSS 0.5%CVE-2026-20158HIGHCisco RoomOS Security Hardening Release - Resource Lifetime Management VulnerabilitiesEPSS 0.5%CVE-2026-20269HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.5%CVE-2026-102026HIGHJunos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is usedEPSS 0.5%CVE-2024-22365MEDIUMlinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat cEPSS 0.5%CVE-2026-68908MEDIUMlibIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send pathEPSS 0.5%CVE-2026-57446MEDIUMlibIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handleEPSS 0.4%CVE-2026-76408CRITICALImproper Control of a Resource Through its Lifetime in Splunk SOAREPSS 0.4%CVE-2026-76282HIGHImproper Control of a Resource Through its Lifetime in Splunk EnterpriseEPSS 0.4%CVE-2023-44295MEDIUM Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A lowEPSS 0.4%CVE-2026-76300HIGHSecurity Hardening in Splunk Enterprise - October 2026EPSS 0.4%