Fallos del tipo CWE-772

107 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2024-20493MEDIUMA vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) SoEPSS 0.5%CVE-2025-36128HIGHIBM MQ denial of serviceEPSS 0.5%CVE-2026-26999HIGHTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)EPSS 0.5%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.5%CVE-2023-22302MEDIUMBIG-IP HTTP profile vulnerabilityEPSS 0.5%CVE-2024-21789HIGHBIG-IP ASM and Advanced WAF vulnerabilityEPSS 0.5%CVE-2023-31274MEDIUMMissing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server EPSS 0.5%CVE-2026-13351HIGHnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsEPSS 0.5%CVE-2026-64607MEDIUMApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSEPSS 0.5%CVE-2026-32874HIGHUltraJSON has a Memory Leak parsing large integers allows DoSEPSS 0.5%CVE-2023-32255MEDIUMKernel: memory leak via ksmbd session setup request with unknown ntlmssp message typeEPSS 0.5%CVE-2023-45814MEDIUMTokens cached in the AuthenticationService are susceptible to reuse in BunkumEPSS 0.4%CVE-2026-12353MEDIUMRhcs: memory leak during https connection leads to denial of serviceEPSS 0.4%CVE-2024-39562HIGHJunos OS Evolved: A high rate of SSH connections causes a Denial of ServiceEPSS 0.4%CVE-2020-14339—A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows EPSS 0.4%CVE-2026-20082HIGHA vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software couldEPSS 0.4%CVE-2025-22891HIGHBIG-IP PEM VulnerabilityEPSS 0.4%CVE-2026-42577HIGHNetty: epoll transport denial of service via RST on half-closed TCP connectionEPSS 0.4%CVE-2025-27421HIGHGoroutine Leak in Abacus SSE ImplementationEPSS 0.4%CVE-2026-92230HIGHApache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingEPSS 0.4%