Fallos del tipo CWE-772

139 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2026-59654MEDIUMApache CloudStack: DoS caused by database connections leakEPSS 0.6%CVE-2024-52303HIGHaiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodEPSS 0.6%CVE-2026-36590HIGHAn issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componEPSS 0.6%CVE-2024-35821HIGHubifs: Set page uptodate in the correct placeEPSS 0.6%CVE-2026-20250HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service VulnerabilityEPSS 0.6%CVE-2024-10396MEDIUMFileserver crash and possible information leak on StoreACL/FetchACLEPSS 0.6%CVE-2026-21874MEDIUMNiceGUI has Redis connection leak via tab storage causes service degradationEPSS 0.6%CVE-2024-20493MEDIUMA vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) SoEPSS 0.6%CVE-2023-32255MEDIUMKernel: memory leak via ksmbd session setup request with unknown ntlmssp message typeEPSS 0.6%CVE-2025-36128HIGHIBM MQ denial of serviceEPSS 0.5%CVE-2023-45814MEDIUMTokens cached in the AuthenticationService are susceptible to reuse in BunkumEPSS 0.5%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.5%CVE-2026-85718MEDIUMAsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceEPSS 0.5%CVE-2023-22302MEDIUMBIG-IP HTTP profile vulnerabilityEPSS 0.5%CVE-2026-94625MEDIUMvLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer PlaceholdersEPSS 0.5%CVE-2024-21789HIGHBIG-IP ASM and Advanced WAF vulnerabilityEPSS 0.5%CVE-2026-32874HIGHUltraJSON has a Memory Leak parsing large integers allows DoSEPSS 0.5%CVE-2023-31274MEDIUMMissing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server EPSS 0.5%CVE-2026-20124HIGHCisco IOS XE Software SNMP Denial of Service VulnerabilityEPSS 0.5%CVE-2026-92230HIGHApache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingEPSS 0.5%