Fallos del tipo CWE-664

64 resultados

Controle inadequado de recurso durante seu ciclo de vida

Fraqueza genérica onde o software falha em gerenciar corretamente um recurso (memória, arquivo, conexão, etc.) desde sua alocação até sua liberação. Sem aquisição, uso ou liberação adequados, o recurso pode vazar, ser acessado após ser destruído, ou ficar em estado inconsistente, abrindo brechas de segurança.

Ejemplo

Um aplicativo abre uma conexão com banco de dados dentro de um bloco try, mas não fecha a conexão em um finally ou try-with-resources. Se uma exceção for lançada, a conexão permanece aberta, esgotando o pool de conexões e causando negação de serviço; ou um ponteiro é desalocado mas o código continua tentando acessá-lo, gerando leitura/escrita em memória inválida.

Cómo mitigar

Use padrões de gerenciamento automático: try-with-resources (Java), context managers (Python), RAII (C++), ou garbage collection. Garanta aquisição em um ponto e liberação em outro bem definido. Para recursos críticos, implemente testes que validem ciclos de vida completos e ferramentas estáticas de análise que detectem leaks e acessos inválidos.

CVE-2026-86203MEDIUMPocketMine-MP before 5.39.2 Item Duplication via Despawn StateEPSS 0.3%CVE-2023-52387HIGHResource reuse vulnerability in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.3%CVE-2026-76500CRITICALCisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime VulnerabilitiesEPSS 0.3%CVE-2022-22250MEDIUMJunos OS and Junos OS Evolved: An FPC crash might be seen due to an EVPN MAC entry moving from local to remoteEPSS 0.3%CVE-2020-1622MEDIUMJunos OS Evolved: EvoSharedObjStore may leak sensitive informationEPSS 0.3%CVE-2020-1621MEDIUMJunos OS Evolved: Configd leaks hashes via stream and is world readableEPSS 0.3%CVE-2020-1620MEDIUMJunos OS Evolved: Configd leaks hashes via log file and is world readableEPSS 0.3%CVE-2026-20336HIGHCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Resource Lifetime Management VulnerabilitiesEPSS 0.3%CVE-2026-79289LOWImproper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comEPSS 0.3%CVE-2020-3504LOWCisco UCS Manager Software Local Management CLI Denial of Service VulnerabilityEPSS 0.3%CVE-2024-23639MEDIUMmicronaut-core management endpoints vulnerable to drive-by localhost attackEPSS 0.3%CVE-2026-76467HIGHCisco Meraki Software Hardening Release - Resource Lifetime Management VulnerabilitiesEPSS 0.3%CVE-2024-7889HIGHLocal privilege escalation allows a low-privileged user to gain SYSTEM privilegesEPSS 0.2%CVE-2025-21593HIGHJunos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crashEPSS 0.2%CVE-2026-79603MEDIUMUnconditionally do TLB flushing ahead of page scrubbingEPSS 0.2%CVE-2020-36774MEDIUMplugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to EPSS 0.2%CVE-2026-8582MEDIUMObject lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive informatioEPSS 0.2%CVE-2026-19380MEDIUMMullvad wireguard.sys IOCTL AdapterState reference countEPSS 0.2%CVE-2026-64721MEDIUMThis issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6,EPSS 0.2%CVE-2026-94192HIGHModule object deallocation can free a live ThreadX kernel objectEPSS 0.1%