Falhas do tipo CWE-401

750 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2024-7095MEDIUMOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being termEPSS 0.5%CVE-2026-52974HIGHnet: tls: fix strparser anchor skb leak on offload RX setup failureEPSS 0.5%CVE-2025-21788HIGHnet: ethernet: ti: am65-cpsw: fix memleak in certain XDP casesEPSS 0.5%CVE-2024-6875MEDIUMInfinispan: infinispan: rest compare api has buffer leakEPSS 0.5%CVE-2026-25988MEDIUMImageMagick's MSL image stack index not refreshed, leading to leaked images.EPSS 0.5%CVE-2025-29910MEDIUMCryptoLib's crypto_handle_incrementing_nontransmitted_counter Function has Memory LeakEPSS 0.5%CVE-2021-47519HIGHcan: m_can: m_can_read_fifo: fix memory leak in error branchEPSS 0.5%CVE-2026-10699HIGHMemory leak in SFTP service can result in a denial of service in MOVEit TransferEPSS 0.5%CVE-2026-92230HIGHApache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingEPSS 0.5%CVE-2026-47482HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifeEPSS 0.5%CVE-2026-110672HIGHCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hvEPSS 0.5%CVE-2026-110677HIGHCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hvEPSS 0.5%CVE-2021-3574—A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.EPSS 0.5%CVE-2026-53229HIGHnet/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failureEPSS 0.5%CVE-2026-22024MEDIUMCryptoLib Memory Leak in KMC Encrypt Function Leads to Resource ExhaustionEPSS 0.5%CVE-2026-87776HIGHcompression vulnerable to Denial of Service via memory leak on premature response closeEPSS 0.5%CVE-2025-20254MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.5%CVE-2025-20252MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.5%CVE-2026-56818MEDIUMNetty: RedisArrayAggregator max-elements failure leaves retained partial aggregate stateEPSS 0.5%CVE-2026-120440MEDIUMQuickJS-NG before 0.16.0 Memory Leak via Atomics.storeEPSS 0.5%