Falhas do tipo CWE-672

81 resultados

Operação em recurso após expiração ou liberação

Ocorre quando o código tenta usar um recurso (arquivo, conexão, memória, token) depois que ele já foi liberado ou expirou. O programa mantém uma referência ou tenta reutilizar algo que não está mais válido, causando comportamento impredizível, corrupção de dados ou exposição de informações.

Exemplo

Um serviço valida um token JWT, o armazena em cache, mas não verifica se ele expirou antes de usá-lo novamente minutos depois. Requisições subsequentes com o token expirado são aceitas porque o código reutiliza o objeto cacheado sem revalidar a data de expiração.

Como mitigar

Sempre verificar timestamp de expiração antes de usar um recurso; implementar mecanismos de invalidação explícita (e.g., remover do cache ao expirar); usar TTL (time-to-live) em estruturas de cache; validar estado do recurso no ponto de uso, não apenas na aquisição.

CVE-2025-30351LOWSuspended Directus user can continue to use session token to access APIEPSS 0.4%CVE-2026-44725MEDIUMEMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionEPSS 0.4%CVE-2026-53637MEDIUMSylius: Cart FormComponent allows modification or deletion of an already-completed orderEPSS 0.4%CVE-2024-25619LOWDestroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonEPSS 0.4%CVE-2026-113121HIGHUse of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enEPSS 0.4%CVE-2013-10075CRITICALApache::Session versions through 1.94 for Perl re-creates deleted sessionsEPSS 0.4%CVE-2026-113216HIGHUse of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2024-4693MEDIUMQemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashEPSS 0.3%CVE-2026-42791MEDIUMOCSP responder certificate validity period not checked in public_keyEPSS 0.3%CVE-2026-30978HIGHHeap-use-after-free in CIccCmm::AddXform()EPSS 0.3%CVE-2026-85044MEDIUMUse of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineeEPSS 0.3%CVE-2025-6031HIGHInsecure device pairing in end of life Amazon Cloud CamEPSS 0.3%CVE-2026-93006MEDIUMDnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentEPSS 0.3%CVE-2026-121256HIGHUse of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%CVE-2024-23332MEDIUMClient configured with permissive trust policies susceptible to rollback attack in Notary ProjectEPSS 0.3%CVE-2026-45005MEDIUMOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationEPSS 0.3%CVE-2026-47087LOWAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted EPSS 0.3%CVE-2025-69415HIGHIn Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2026-79010MEDIUMOperation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comEPSS 0.3%