Falhas do tipo CWE-401

749 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2022-43032MEDIUMAn issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescripEPSS 0.7%CVE-2025-20224MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software anEPSS 0.7%CVE-2025-20225MEDIUMA vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive SecuEPSS 0.7%CVE-2026-18212HIGHKeycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib stateEPSS 0.7%CVE-2022-1515—A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially EPSS 0.7%CVE-2022-4132MEDIUMMemory leak on tls connectionsEPSS 0.7%CVE-2024-7884HIGHMemory leak when calling a canister method via `ic_cdk::call`EPSS 0.7%CVE-2022-43037MEDIUMAn issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.EPSS 0.7%CVE-2026-63446HIGHSuricata app-layer: passed flows can retain transactions, causing resource exhaustionEPSS 0.7%CVE-2026-86040HIGHlibp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoSEPSS 0.7%CVE-2023-5349MEDIUMDraw while calling getdrawinfo()EPSS 0.7%CVE-2026-56819HIGHNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)EPSS 0.7%CVE-2026-58175HIGHApache Traffic Server: HostDB SRV handling leaks memoryEPSS 0.7%CVE-2023-22417HIGHJunos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crashEPSS 0.7%CVE-2024-25450HIGHimlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().EPSS 0.7%CVE-2023-40534HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.7%CVE-2023-28982HIGHJunos OS and Junos OS Evolved: In a BGP rib sharding scenario when a route is frequently updated an rpd memory leak will occurEPSS 0.6%CVE-2026-35505HIGHOFFIS DCMTK Toolkit Missing Release of Memory after Effective LifetimeEPSS 0.6%CVE-2026-50254HIGHOFFIS DCMTK Toolkit Missing Release of Memory after Effective LifetimeEPSS 0.6%CVE-2026-69405MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%