Fallos del tipo CWE-772

107 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2021-21600MEDIUMDell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentEPSS 0.8%CVE-2023-36533HIGHUncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network accEPSS 0.8%CVE-2023-47124MEDIUMDenial of service whith ACME HTTPChallenge in TraefikEPSS 0.8%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.8%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.7%CVE-2026-3104HIGHMemory leak in code preparing DNSSEC proofs of non-existenceEPSS 0.7%CVE-2026-69664HIGHhttpd parks a request worker indefinitely on a malformed chunk size sent after the headersEPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2024-28882MEDIUMOpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the valiEPSS 0.7%CVE-2026-2359HIGHMulter vulnerable to Denial of Service via resource exhaustionEPSS 0.7%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.7%CVE-2023-20095HIGHA vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDEPSS 0.6%CVE-2026-39830CRITICALInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshEPSS 0.6%CVE-2024-52303HIGHaiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodEPSS 0.6%CVE-2026-36590HIGHAn issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componEPSS 0.6%CVE-2024-35821HIGHubifs: Set page uptodate in the correct placeEPSS 0.6%CVE-2026-15713MEDIUMLibsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leakEPSS 0.6%CVE-2026-21874MEDIUMNiceGUI has Redis connection leak via tab storage causes service degradationEPSS 0.6%CVE-2024-10396MEDIUMFileserver crash and possible information leak on StoreACL/FetchACLEPSS 0.6%CVE-2026-20250HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service VulnerabilityEPSS 0.5%