Falhas do tipo CWE-401

749 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-114613HIGHMessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failureEPSS 0.5%CVE-2026-22025MEDIUMCryptoLib Memory Leak on HTTP Error Response in KMC ClientEPSS 0.5%CVE-2026-30873LOWOpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokensEPSS 0.5%CVE-2025-1816MEDIUMFFmpeg IAMF File iamf_parse.c audio_element_obu memory leakEPSS 0.5%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.5%CVE-2021-3744—A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackeEPSS 0.5%CVE-2026-52981HIGHneigh: let neigh_xmit take skb ownershipEPSS 0.5%CVE-2026-73565MEDIUM@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakeEPSS 0.5%CVE-2026-53397HIGHnfsd: fix posix_acl leak on SETACL decode failureEPSS 0.5%CVE-2026-16318MEDIUMQUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tlsEPSS 0.5%CVE-2026-54876HIGHClient-Side Memory Leak in OCSP Response CheckingEPSS 0.5%CVE-2026-47667HIGHCImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze HeaderEPSS 0.5%CVE-2024-4435MEDIUMBTreeMap memory leak when deallocating nodes with overflowsEPSS 0.5%CVE-2023-4513MEDIUMMissing Release of Memory after Effective Lifetime in WiresharkEPSS 0.5%CVE-2026-67183HIGHTinyWeb 0.0.8 Memory Leak DoS via HTTP Request HandlingEPSS 0.5%CVE-2026-110685CRITICALCpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tagEPSS 0.5%CVE-2026-52734MEDIUMZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retentionEPSS 0.5%CVE-2025-53537HIGHLibHTP's memory leak with lzma can lead to resource starvationEPSS 0.5%CVE-2026-18076MEDIUMIBM i is Affected By Multiple Vulnerabilities in Debug ServerEPSS 0.5%CVE-2024-7095MEDIUMOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being termEPSS 0.5%