Falhas do tipo CWE-401

664 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-90784MEDIUMDvidelabs flatcc semantics.c fb_clear_parser memory leakEPSS 0.4%CVE-2025-30658HIGHJunos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will cause memory to leak ultimately causing forwarding to stopEPSS 0.4%CVE-2026-12932HIGHA memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackersEPSS 0.4%CVE-2025-20254MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.4%CVE-2025-20252MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.4%CVE-2024-53984MEDIUMNanopb does not release memory on error return when using PB_DECODE_DELIMITEDEPSS 0.4%CVE-2024-56632HIGHnvme-tcp: fix the memleak while create new ctrl failedEPSS 0.4%CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.4%CVE-2025-8277LOWLibssh: memory exhaustion via repeated key exchange in libsshEPSS 0.4%CVE-2019-3815LOWA memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in joEPSS 0.4%CVE-2026-58175HIGHApache Traffic Server: HostDB SRV handling leaks memoryEPSS 0.4%CVE-2026-92230HIGHApache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingEPSS 0.4%CVE-2021-31367MEDIUMJunos OS: PTX Series: An FPC heap memory leak will be triggered by certain Flowspec route operations which can lead to an FPC crashEPSS 0.4%CVE-2022-22168MEDIUMJunos OS: vMX and MX150: Specific packets might cause a memory leak and eventually an FPC rebootEPSS 0.4%CVE-2025-26307MEDIUMA memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to causeEPSS 0.4%CVE-2025-26308MEDIUMA memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a EPSS 0.4%CVE-2025-26306MEDIUMA memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denialEPSS 0.4%CVE-2025-26311MEDIUMMultiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in utiEPSS 0.4%CVE-2026-16318MEDIUMQUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tlsEPSS 0.4%CVE-2026-63446HIGHSuricata app-layer: passed flows can retain transactions, causing resource exhaustionEPSS 0.4%