Falhas do tipo CWE-401

750 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2021-3544—Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They existEPSS 0.4%CVE-2026-48987MEDIUMpyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerEPSS 0.4%CVE-2024-26462MEDIUMKerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.EPSS 0.4%CVE-2025-30658HIGHJunos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will cause memory to leak ultimately causing forwarding to stopEPSS 0.4%CVE-2026-21714MEDIUMA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cEPSS 0.4%CVE-2025-8277LOWLibssh: memory exhaustion via repeated key exchange in libsshEPSS 0.4%CVE-2026-25796MEDIUMImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return pathsEPSS 0.4%CVE-2019-20386MEDIUMAn issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory EPSS 0.4%CVE-2026-79771MEDIUMNokogiri before 1.19.3 Memory Leak via XSLT TransformEPSS 0.4%CVE-2021-0272MEDIUMJunos OS: QFX10002-32Q, QFX10002-60C, QFX10002-72Q, QFX10008, QFX10016: In EVPN-VXLAN scenarios receipt of specific genuine packets by an adjacent attacker will cause a kernel memory leak in FPC.EPSS 0.4%CVE-2026-44660HIGHUltraJSON: Memory Leak in ujson.dump() on Write FailureEPSS 0.4%CVE-2026-119286HIGHGraphQL-core: Denial of service via memory leak in aborted validationsEPSS 0.4%CVE-2026-109263MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV EncoderEPSS 0.4%CVE-2026-109261MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF EncoderEPSS 0.4%CVE-2026-48141MEDIUMMemory leak in NI grpc-device BeginSidebandStreamEPSS 0.4%CVE-2026-109260MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG EncoderEPSS 0.4%CVE-2026-12932HIGHA memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackersEPSS 0.4%CVE-2026-21438MEDIUMwebtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams MapEPSS 0.4%CVE-2026-78127LOWlibcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.EPSS 0.4%CVE-2024-53984MEDIUMNanopb does not release memory on error return when using PB_DECODE_DELIMITEDEPSS 0.4%