Falhas do tipo CWE-401

750 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-44806MEDIUMWindows Secure Channel Denial of Service VulnerabilityEPSS 1.2%CVE-2026-70065HIGHWindows DHCP Server Denial of Service VulnerabilityEPSS 1.2%CVE-2026-69588HIGHWindows TCP/IP Denial of Service VulnerabilityEPSS 1.2%CVE-2024-27507HIGHlibLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.EPSS 1.2%CVE-2024-24259HIGHfreeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.EPSS 1.1%CVE-2024-24258HIGHfreeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.EPSS 1.1%CVE-2026-4247HIGHTCP: remotely exploitable DoS vector (mbuf leak)EPSS 1.1%CVE-2026-69497MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 1.1%CVE-2023-33460MEDIUMThere's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.EPSS 1.1%CVE-2020-27822—A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an applicationEPSS 1.1%CVE-2021-34431—In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to theEPSS 1.1%CVE-2023-25566HIGHGSS-NTLMSSP vulnerable to memory leak when parsing usernamesEPSS 1.1%CVE-2026-83677HIGHWindows DHCP Client Denial of Service VulnerabilityEPSS 1.1%CVE-2021-20193—A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to causeEPSS 1.1%CVE-2020-11637MEDIUMAutomation Runtime TFTP Service DoS VulnerabilityEPSS 1.1%CVE-2020-1683HIGHJunos OS: Memory leak leads to kernel crash (vmcore) due to SNMP pollingEPSS 1.1%CVE-2022-22209HIGHJunos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churnEPSS 1.0%CVE-2022-23585MEDIUMMemory leak in decoding PNG images in TensorflowEPSS 1.0%CVE-2025-1634HIGHIo.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeoutEPSS 1.0%CVE-2022-43222HIGHopen5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c. This vulnerability allows attackers to cause aEPSS 1.0%