Falhas do tipo CWE-401

745 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2024-24150MEDIUMA memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF fileEPSS 0.8%CVE-2026-93436HIGHvLLM through 0.29.0 Memory Exhaustion via Rejected RequestsEPSS 0.8%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.8%CVE-2024-8376HIGHMemory leakEPSS 0.7%CVE-2024-24147MEDIUMA memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF EPSS 0.7%CVE-2019-5023MEDIUMAn exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9EPSS 0.7%CVE-2024-27508HIGHAtheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.EPSS 0.7%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.7%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.7%CVE-2025-0241HIGHMemory corruption when using JavaScript Text SegmentationEPSS 0.7%CVE-2023-30637HIGHBaidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server. NOTE: installations with brpc-0.14.0EPSS 0.7%CVE-2022-41624HIGHBIG-IP iRules vulnerability CVE-2022-41624EPSS 0.7%CVE-2022-41832HIGHBIG-IP SIP vulnerability CVE-2022-41832EPSS 0.7%CVE-2026-90784MEDIUMDvidelabs flatcc semantics.c fb_clear_parser memory leakEPSS 0.7%CVE-2022-23578MEDIUMMemory leak in TensorflowEPSS 0.7%CVE-2022-22204MEDIUMJunos OS: MX Series and SRX Series: When receiving a specific SIP packets stale call table entries are created which eventually leads to a DoS for all SIP trafficEPSS 0.7%CVE-2023-33718HIGHmp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cppEPSS 0.7%CVE-2023-5954MEDIUMVault Requests Triggering Policy Checks May Lead To Unbounded Memory ConsumptionEPSS 0.7%CVE-2025-20225MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive SecuEPSS 0.7%