Falhas do tipo CWE-664

43 resultados

Controle inadequado de recurso durante seu ciclo de vida

É quando o código não gerencia corretamente a alocação, uso e liberação de um recurso (memória, arquivo, conexão de rede, etc.) do início ao fim de sua existência. O recurso pode vazar, ser acessado após liberação, ou ficar em estado inconsistente, criando brechas de segurança e instabilidade.

Exemplo

Uma aplicação abre uma conexão de banco de dados em uma função, usa para fazer uma query, mas se uma exceção ocorrer antes do close(), a conexão nunca é fechada. Se isso acontecer repetidamente, o pool de conexões se esgota e ninguém mais consegue acessar o banco.

Como mitigar

Use sempre mecanismos de limpeza garantida: try-finally, context managers (with em Python, try-with-resources em Java), destructores confiáveis. Implemente testes que forçam exceções em pontos críticos para validar que recursos são liberados mesmo com falhas.

CVE-2022-27518CRITICALUnauthenticated remote arbitrary code executionEPSS 6.9%KEVCVE-2022-2048HIGHIn Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noEPSS 2.3%CVE-2022-2191HIGHIn Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByEPSS 2.1%CVE-2020-3175HIGHCisco MDS 9000 Series Multilayer Switches Denial of Service VulnerabilityEPSS 2.0%CVE-2024-45383MEDIUMA mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36EPSS 1.5%CVE-2019-16779MEDIUMIn RubyGem excon, interrupted Persistent Connections May Leak Response DataEPSS 1.4%CVE-2022-31153MEDIUMOpenZeppelin Contracts for Cairo account cannot process transactions on GoerliEPSS 1.4%CVE-2022-20748MEDIUMCisco Firepower Threat Defense Software Local Malware Analysis Denial of Service VulnerabilityEPSS 1.2%CVE-2022-20856HIGHCisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service VulnerabilityEPSS 1.2%CVE-2021-1592MEDIUMCisco UCS Manager Software SSH Sessions Denial of Service VulnerabilityEPSS 1.0%CVE-2022-27512—Temporary disruption of the ADM license serviceEPSS 0.9%CVE-2022-46144HIGHA vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) EPSS 0.9%CVE-2022-1385LOWInvitation Email is resent as a Reminder after invalidating pending email invitesEPSS 0.8%CVE-2023-44288HIGH Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. An unauthentEPSS 0.7%CVE-2025-34226HIGHOpenPLC Runtime v3 Persistent DoSEPSS 0.6%CVE-2022-32846HIGHA logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to accEPSS 0.6%CVE-2023-25942MEDIUM Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. A malicious network user with low prEPSS 0.6%CVE-2024-41169HIGHApache Zeppelin: raft directory listing and file readEPSS 0.6%CVE-2022-28287MEDIUMIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability afEPSS 0.5%CVE-2026-8517HIGHObject lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage EPSS 0.5%