Falhas do tipo CWE-672

81 resultados

Operação em recurso após expiração ou liberação

Ocorre quando o código tenta usar um recurso (arquivo, conexão, memória, token) depois que ele já foi liberado ou expirou. O programa mantém uma referência ou tenta reutilizar algo que não está mais válido, causando comportamento impredizível, corrupção de dados ou exposição de informações.

Exemplo

Um serviço valida um token JWT, o armazena em cache, mas não verifica se ele expirou antes de usá-lo novamente minutos depois. Requisições subsequentes com o token expirado são aceitas porque o código reutiliza o objeto cacheado sem revalidar a data de expiração.

Como mitigar

Sempre verificar timestamp de expiração antes de usar um recurso; implementar mecanismos de invalidação explícita (e.g., remover do cache ao expirar); usar TTL (time-to-live) em estruturas de cache; validar estado do recurso no ponto de uso, não apenas na aquisição.

CVE-2026-72108HIGHdm thin metadata: fix metadata snapshot consistency on commit failureEPSS 0.3%CVE-2026-96589MEDIUMGitea private repository access retained after rejected transferEPSS 0.2%CVE-2026-33463MEDIUMOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessEPSS 0.2%CVE-2026-32244MEDIUMDiscourse: Cached outdated summaries can leak removed contentEPSS 0.2%CVE-2026-1629MEDIUMPermalink Preview Information Disclosure After Permission RevocationEPSS 0.2%CVE-2026-106310MEDIUMUse of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer prEPSS 0.2%CVE-2026-2379HIGHArista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is DisabledEPSS 0.2%CVE-2026-95366MEDIUMUse of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-50575HIGHBetterDesk has a replay behavior vulnerability when devices are deletedEPSS 0.2%CVE-2025-31253HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a EPSS 0.2%CVE-2026-106345MEDIUMUse of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2025-39698HIGHio_uring/futex: ensure io_futex_wait() cleans up properly on failureEPSS 0.2%CVE-2024-56674MEDIUMvirtio_net: correct netdev_tx_reset_queue() invocation pointEPSS 0.2%CVE-2026-42955LOWExtra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue recordsEPSS 0.2%CVE-2026-106339LOWUse of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-106320MEDIUMUse of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process toEPSS 0.2%CVE-2026-4053LOWpost edit time limit is not enforced on some post update operationsEPSS 0.2%CVE-2025-21117MEDIUMDell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentialEPSS 0.2%CVE-2026-1237LOWVulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upEPSS 0.1%CVE-2026-115402MEDIUMOpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition iEPSS 0.1%