Falhas do tipo CWE-404

695 resultados

Liberação inadequada de recursos

Ocorre quando o software não libera corretamente recursos como conexões de banco de dados, arquivos abertos, memória ou sockets de rede. Isso leva a esgotamento de recursos (resource leak), causando travamentos, negação de serviço ou comportamento imprevisível da aplicação ao longo do tempo.

Exemplo

Um servidor web que abre uma conexão com banco de dados para cada requisição, mas não a fecha adequadamente em caso de erro — após milhares de requisições, todas as conexões disponíveis se esgotam e novas requisições falham ou travam.

Como mitigar

Use padrões como try-finally ou try-with-resources (em Java) para garantir que recursos sejam liberados mesmo em exceções. Implemente timeouts e monitoramento de recursos abertos; realize testes de carga para detectar leaks antes da produção.

CVE-2023-1444HIGHFilseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of serviceEPSS 1.3%CVE-2024-22025MEDIUMA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetEPSS 1.3%CVE-2024-0261MEDIUMSentex FTPDMIN RNFR Command denial of serviceEPSS 1.3%CVE-2024-0693MEDIUMEFS Easy File Sharing FTP denial of serviceEPSS 1.3%CVE-2023-2380MEDIUMNetgear SRX5308 denial of serviceEPSS 1.3%CVE-2023-7209HIGHUniway Router Device Reset device_reset.cgi denial of serviceEPSS 1.3%CVE-2023-2379HIGHUbiquiti EdgeRouter X Web Service denial of serviceEPSS 1.3%CVE-2013-1055MEDIUMPotential DoS through abuse of rate limit in libunity-webapps for FirefoxEPSS 1.3%CVE-2024-11650HIGHTenda i9 GetIPTV websReadEvent null pointer dereferenceEPSS 1.3%CVE-2024-4791HIGHContemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of serviceEPSS 1.3%CVE-2021-4433MEDIUMKarjasoft Sami HTTP Server HTTP HEAD Rrequest denial of serviceEPSS 1.3%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2025-5867HIGHRT-Thread lwp_syscall.c csys_sendto null pointer dereferenceEPSS 1.2%CVE-2022-3299MEDIUMOpen5GS AMF client.c denial of serviceEPSS 1.2%CVE-2023-2789LOWGNU cflow parser.c parse_variable_declaration denial of serviceEPSS 1.2%CVE-2019-0028HIGHJunos OS: RPD process crashes due to specific BGP peer restarts condition.EPSS 1.2%CVE-2020-14307MEDIUMA vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations aEPSS 1.2%CVE-2017-20024MEDIUMSolare Solar-Log denial of serviceEPSS 1.2%CVE-2019-25104LOWrtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of serviceEPSS 1.2%CVE-2023-29726HIGHThe Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty dEPSS 1.2%