Falhas do tipo CWE-401

664 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2024-39549HIGHJunos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to a memory leakEPSS 0.5%CVE-2024-5294MEDIUMD-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service VulnerabilityEPSS 0.5%CVE-2025-61974HIGHBIG-IP SSL/TLS vulnerabilityEPSS 0.5%CVE-2024-50170HIGHnet: bcmasp: fix potential memory leak in bcmasp_xmit()EPSS 0.5%CVE-2026-21714MEDIUMA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cEPSS 0.5%CVE-2025-21091HIGHBIG-IP SNMP vulnerabilityEPSS 0.5%CVE-2026-94627HIGHvLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID CollisionEPSS 0.4%CVE-2026-56819HIGHNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)EPSS 0.4%CVE-2024-7708HIGHFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case forEPSS 0.4%CVE-2026-63448MEDIUMSuricata smb: some SMB flows can cause resource exhaustionEPSS 0.4%CVE-2026-25988MEDIUMImageMagick's MSL image stack index not refreshed, leading to leaked images.EPSS 0.4%CVE-2024-26462MEDIUMKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.EPSS 0.4%CVE-2021-3544—Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They existEPSS 0.4%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.4%CVE-2019-20386MEDIUMAn issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory EPSS 0.4%CVE-2021-0272MEDIUMJunos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC.EPSS 0.4%CVE-2026-63252HIGHIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel EPSS 0.4%CVE-2026-44660HIGHUltraJSON: Memory Leak in ujson.dump() on Write FailureEPSS 0.4%CVE-2026-48141MEDIUMMemory leak in NI grpc-device BeginSidebandStreamEPSS 0.4%CVE-2025-53537HIGHLibHTP's memory leak with lzma can lead to resource starvationEPSS 0.4%