Fallos del tipo CWE-772

139 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2026-13351HIGHnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsEPSS 0.5%CVE-2026-18149MEDIUMundici vulnerable to Denial of Service via orphaned RetryHandler response bodyEPSS 0.5%CVE-2026-20082HIGHA vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software couldEPSS 0.5%CVE-2026-22997HIGHnet: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rtsEPSS 0.5%CVE-2026-64607MEDIUMApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSEPSS 0.5%CVE-2026-59951MEDIUMMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionEPSS 0.5%CVE-2026-73215HIGHThe coturn server can end in a state where it does not accept more requests with "even-port" enabled.EPSS 0.5%CVE-2026-107286HIGHPydantic AI: Concurrency-limited models can keep their slot when a streamed request ends earlyEPSS 0.4%CVE-2026-12353MEDIUMRhcs: memory leak during https connection leads to denial of serviceEPSS 0.4%CVE-2024-39562HIGHJunos OS Evolved: A high rate of SSH connections causes a Denial of ServiceEPSS 0.4%CVE-2026-13505HIGHZeroisation of sensitive key material on garbage collection relies on finalizationEPSS 0.4%CVE-2026-79677HIGHApache Tomcat: WebSocket DoS due to lost asynchronous write timeoutEPSS 0.4%CVE-2020-14339—A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows EPSS 0.4%CVE-2026-59320MEDIUMIn Spring AMQP the link credit never replenished on listener exception pathEPSS 0.4%CVE-2026-112200HIGHResource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endiannessEPSS 0.4%CVE-2025-27421HIGHGoroutine Leak in Abacus SSE ImplementationEPSS 0.4%CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%CVE-2026-49343MEDIUMKlever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSEPSS 0.4%CVE-2026-42577HIGHNetty: epoll transport denial of service via RST on half-closed TCP connectionEPSS 0.4%CVE-2025-14969MEDIUMHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectEPSS 0.4%