Falhas do tipo CWE-664

64 resultados

Controle inadequado de recurso durante seu ciclo de vida

É quando o código não gerencia corretamente a alocação, uso e liberação de um recurso (memória, arquivo, conexão de rede, etc.) do início ao fim de sua existência. O recurso pode vazar, ser acessado após liberação, ou ficar em estado inconsistente, criando brechas de segurança e instabilidade.

Exemplo

Uma aplicação abre uma conexão de banco de dados em uma função, usa para fazer uma query, mas se uma exceção ocorrer antes do close(), a conexão nunca é fechada. Se isso acontecer repetidamente, o pool de conexões se esgota e ninguém mais consegue acessar o banco.

Como mitigar

Use sempre mecanismos de limpeza garantida: try-finally, context managers (with em Python, try-with-resources em Java), destructores confiáveis. Implemente testes que forçam exceções em pontos críticos para validar que recursos são liberados mesmo com falhas.

CVE-2026-18549HIGH@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limitEPSS 0.6%CVE-2022-28287MEDIUMIn unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability afEPSS 0.6%CVE-2026-20274CRITICALCisco IOS XR Software Security Hardening Release: September 2026EPSS 0.5%CVE-2026-20353CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 0.5%CVE-2026-54251HIGHnetty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of ServiceEPSS 0.5%CVE-2026-8517HIGHObject lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage EPSS 0.5%CVE-2022-22249MEDIUMJunos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domainEPSS 0.5%CVE-2026-57187HIGHAsterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processingEPSS 0.5%CVE-2024-37139MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through itsEPSS 0.5%CVE-2026-43158HIGHxfs: fix freemap adjustments when adding xattrs to leaf blocksEPSS 0.5%CVE-2026-20158HIGHCisco RoomOS Security Hardening Release - Resource Lifetime Management VulnerabilitiesEPSS 0.5%CVE-2026-20269HIGHCisco IOS XE Software Security Hardening ReleaseEPSS 0.5%CVE-2026-102026HIGHJunos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB sharding is usedEPSS 0.5%CVE-2024-22365MEDIUMlinux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat cEPSS 0.5%CVE-2026-68908MEDIUMlibIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send pathEPSS 0.5%CVE-2026-57446MEDIUMlibIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handleEPSS 0.4%CVE-2026-76408CRITICALImproper Control of a Resource Through its Lifetime in Splunk SOAREPSS 0.4%CVE-2026-76282HIGHImproper Control of a Resource Through its Lifetime in Splunk EnterpriseEPSS 0.4%CVE-2023-44295MEDIUM Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. A lowEPSS 0.4%CVE-2026-76300HIGHSecurity Hardening in Splunk Enterprise - October 2026EPSS 0.4%