Fallos del tipo CWE-672

81 resultados

Operação em recurso após expiração ou liberação

A aplicação tenta usar um recurso (conexão, arquivo, memória, token, etc.) após ele ter sido liberado, expirado ou se tornado inválido. O código não verifica se o recurso ainda está disponível antes de acessá-lo, causando comportamentos imprevíveis: crash, corrupção de dados ou exploração de segurança.

Ejemplo

Um programa fecha uma conexão com banco de dados em uma thread, mas outra thread continua tentando executar queries usando a mesma conexão. Ou uma aplicação web usa um token de autenticação após seu tempo de expiração ter passado sem revalidar.

Cómo mitigar

Sempre valide o estado do recurso antes de usá-lo (check se está ativo, não expirou, não foi liberado). Use gerenciadores de recurso com escopo claro (finally, context managers em Python, try-with-resources em Java) e implemente timeouts com lógica de renewal para recursos sensíveis à expiração.

CVE-2026-72108HIGHdm thin metadata: fix metadata snapshot consistency on commit failureEPSS 0.3%CVE-2026-96589MEDIUMGitea private repository access retained after rejected transferEPSS 0.2%CVE-2026-33463MEDIUMOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%CVE-2026-106310MEDIUMUse of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-2379HIGHArista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is DisabledEPSS 0.2%CVE-2026-95366MEDIUMUse of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2025-31253HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a EPSS 0.2%CVE-2026-106345MEDIUMUse of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2025-39698HIGHio_uring/futex: ensure io_futex_wait() cleans up properly on failureEPSS 0.2%CVE-2024-56674MEDIUMvirtio_net: correct netdev_tx_reset_queue() invocation pointEPSS 0.2%CVE-2026-42955LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsEPSS 0.2%CVE-2026-106339LOWUse of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-106320MEDIUMUse of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process toEPSS 0.2%CVE-2026-4053LOWpost edit time limit is not enforced on some post update operationsEPSS 0.2%CVE-2025-21117MEDIUMDell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentialEPSS 0.2%CVE-2026-1237LOWVulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upEPSS 0.1%CVE-2026-115402MEDIUMOpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition iEPSS 0.1%