Falhas do tipo CWE-401

664 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2026-56018HIGHJavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growthEPSS 0.6%CVE-2026-13708HIGHImager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiolEPSS 0.6%CVE-2025-1151LOWGNU Binutils ld xmemdup.c xmemdup memory leakEPSS 0.6%CVE-2024-25770MEDIUMlibming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.EPSS 0.6%CVE-2024-20304HIGHCisco IOS XR Software Packet Memory Exhaustion VulnerabilityEPSS 0.6%CVE-2025-46784HIGHA denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. A speEPSS 0.6%CVE-2022-22173HIGHJunos OS: CRL failing to download causes a memory leak and ultimately a DoSEPSS 0.6%CVE-2024-21611HIGHJunos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crashEPSS 0.6%CVE-2025-20239HIGHA vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive SecuEPSS 0.6%CVE-2025-46420MEDIUMLibsoup: memory leak on soup_header_parse_quality_list() via soup-headers.cEPSS 0.6%CVE-2025-1149LOWGNU Binutils ld xmalloc.c xstrdup memory leakEPSS 0.6%CVE-2024-22563HIGHopenvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.EPSS 0.6%CVE-2026-69405MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-13474HIGHDenial of service via malformed HTTP/2 requestsEPSS 0.6%CVE-2025-23165LOWIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocatedEPSS 0.6%CVE-2026-22025MEDIUMCryptoLib Memory Leak on HTTP Error Response in KMC ClientEPSS 0.5%CVE-2024-53178HIGHsmb: Don't leak cfid when reconnect races with open_cached_dirEPSS 0.5%CVE-2026-93436HIGHvLLM through 0.29.0 Memory Exhaustion via Rejected RequestsEPSS 0.5%CVE-2023-40534HIGHBIG-IP HTTP/2 vulnerabilityEPSS 0.5%CVE-2026-63128HIGHRMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceEPSS 0.5%