Fallos del tipo CWE-772

107 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2026-94625MEDIUMvLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer PlaceholdersEPSS 0.3%CVE-2026-39455HIGHBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2025-36071MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-59320MEDIUMIn Spring AMQP the link credit never replenished on listener exception pathEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2026-40209MEDIUMDenial of service via IXFR queriesEPSS 0.3%CVE-2022-28187MEDIUMNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management softwareEPSS 0.3%CVE-2026-41637LOWDegradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queriesEPSS 0.3%CVE-2023-22996MEDIUMIn the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with pEPSS 0.3%CVE-2026-56444MEDIUMDegradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configurationEPSS 0.3%CVE-2026-13505HIGHZeroisation of sensitive key material on garbage collection relies on finalizationEPSS 0.3%CVE-2026-11811LOWSocket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSEPSS 0.3%CVE-2026-72931MEDIUMWindows Secure Socket Tunneling Protocol (SSTP) Denial of Service VulnerabilityEPSS 0.3%CVE-2026-9156MEDIUMTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.2%CVE-2026-54786LOWWasmtime: Leak in WASIp1 `fd_renumber` implementationEPSS 0.2%CVE-2021-47389MEDIUMKVM: SVM: fix missing sev_decommission in sev_receive_startEPSS 0.2%CVE-2025-61670LOWWasmtime has memory leak in C API with `externref` and `anyref` typesEPSS 0.2%CVE-2024-53074MEDIUMwifi: iwlwifi: mvm: don't leak a link on AP removalEPSS 0.2%CVE-2025-44003MEDIUMMissing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to tEPSS 0.2%CVE-2024-22383MEDIUM Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not auEPSS 0.2%