Falhas do tipo CWE-401

745 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2025-21599HIGHJunos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of ServiceEPSS 0.6%CVE-2024-25770MEDIUMlibming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.EPSS 0.6%CVE-2024-20304HIGHCisco IOS XR Software Packet Memory Exhaustion VulnerabilityEPSS 0.6%CVE-2025-46420MEDIUMLibsoup: memory leak on soup_header_parse_quality_list() via soup-headers.cEPSS 0.6%CVE-2022-22173HIGHJunos OS: CRL failing to download causes a memory leak and ultimately a DoSEPSS 0.6%CVE-2024-21611HIGHJunos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crashEPSS 0.6%CVE-2026-63252HIGHIn Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel EPSS 0.6%CVE-2026-69781MEDIUMWindows DHCP Client Denial of Service VulnerabilityEPSS 0.6%CVE-2025-1149LOWGNU Binutils ld xmalloc.c xstrdup memory leakEPSS 0.6%CVE-2026-20281HIGHCisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service VulnerabilityEPSS 0.6%CVE-2026-81563HIGHSVCB AliasMode additional-data error leaks qpcache referencesEPSS 0.6%CVE-2024-22563HIGHopenvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.EPSS 0.6%CVE-2026-46102HIGHnet: strparser: fix skb_head leak in strp_abort_strp()EPSS 0.6%CVE-2025-23165LOWIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocatedEPSS 0.6%CVE-2026-13474HIGHDenial of service via malformed HTTP/2 requestsEPSS 0.6%CVE-2026-73550HIGHEnvoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in EnvoyEPSS 0.6%CVE-2026-71675HIGHAn issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.cEPSS 0.5%CVE-2026-13698MEDIUMA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valiEPSS 0.5%CVE-2024-56779CRITICALnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occurEPSS 0.5%CVE-2024-53178HIGHsmb: Don't leak cfid when reconnect races with open_cached_dirEPSS 0.5%