Fallos del tipo CWE-772

139 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2026-94651HIGHApache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse errorEPSS 0.3%CVE-2026-118262HIGHEcho: WebSocket proxy can retain connections and handlers after client disconnectEPSS 0.3%CVE-2026-39455HIGHBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2026-93926HIGHApache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pathEPSS 0.3%CVE-2026-90870MEDIUMUnauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP ServerEPSS 0.3%CVE-2022-28187MEDIUMNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management softwareEPSS 0.3%CVE-2023-22996MEDIUMIn the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with pEPSS 0.3%CVE-2026-9156MEDIUMTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.2%CVE-2026-121391MEDIUMFreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATEEPSS 0.2%CVE-2021-47389MEDIUMKVM: SVM: fix missing sev_decommission in sev_receive_startEPSS 0.2%CVE-2026-81039MEDIUMBluetooth Host connection reservation leak when multiple connectable advertising sets share an identityEPSS 0.2%CVE-2026-16678MEDIUMIBM Power Systems Firmware Denial of ServiceEPSS 0.2%CVE-2025-44003MEDIUMMissing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to tEPSS 0.2%CVE-2025-61670LOWWasmtime has memory leak in C API with `externref` and `anyref` typesEPSS 0.2%CVE-2024-53074MEDIUMwifi: iwlwifi: mvm: don't leak a link on AP removalEPSS 0.2%CVE-2026-119636HIGHImproper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.2EPSS 0.2%CVE-2026-19937MEDIUMBluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responsesEPSS 0.2%CVE-2026-77205LOWDenial of Service via sending bogus X.509 certificatesEPSS 0.2%CVE-2024-22383MEDIUM Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not auEPSS 0.2%