Falhas do tipo CWE-401

664 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-67183HIGHTinyWeb 0.0.8 Memory Leak DoS via HTTP Request HandlingEPSS 0.4%CVE-2025-56226MEDIUMLibsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file.EPSS 0.4%CVE-2026-87776HIGHcompression vulnerable to Denial of Service via memory leak on premature response closeEPSS 0.4%CVE-2021-34740HIGHCisco Aironet Access Points WLAN Control Protocol Packet Buffer Leak Denial of Service VulnerabilityEPSS 0.4%CVE-2024-0240MEDIUMSilicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clientsEPSS 0.4%CVE-2026-25969MEDIUMImageMagick has Memory Leak in coders/ashlar.cEPSS 0.4%CVE-2024-9135MEDIUMOn affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.EPSS 0.4%CVE-2026-76235HIGHCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlEPSS 0.4%CVE-2026-20012HIGHA vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall AEPSS 0.4%CVE-2026-78127LOWlibcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.EPSS 0.4%CVE-2026-3650HIGHGrassroots DICOM Missing release of memory after effective lifetimeEPSS 0.4%CVE-2020-25704—A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local useEPSS 0.4%CVE-2026-61871MEDIUMImageMagick before 7.1.2-26 Memory Leak in ICON decoderEPSS 0.4%CVE-2023-2602—A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_creEPSS 0.4%CVE-2026-67437HIGHOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)EPSS 0.4%CVE-2026-33856HIGHMissing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7EPSS 0.3%CVE-2023-33719MEDIUMmp4v2 v2.1.3 was discovered to contain a memory leak via MP4SdpAtom::Read() at atom_sdp.cppEPSS 0.3%CVE-2026-0646HIGHRockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple VulnerabilitiesEPSS 0.3%CVE-2022-3629LOWLinux Kernel af_vsock.c vsock_connect memory leakEPSS 0.3%CVE-2025-43816MEDIUMA memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and LifeEPSS 0.3%