Falhas do tipo CWE-772

89 resultados

Vazamento de recurso por falta de liberação

Ocorre quando o código adquire um recurso (memória, arquivo, conexão, handle) e nunca o libera explicitamente, mesmo após não precisar mais dele. O recurso fica ocupado indefinidamente, consumindo memória ou limitando a capacidade do sistema até causar esgotamento e falha de serviço.

Exemplo

Uma função abre um arquivo com fopen() para ler dados, processa o conteúdo, mas retorna sem chamar fclose(). Se a função for chamada repetidamente (ou em caso de exceção antes do close), os descritores de arquivo se acumulam até o limite do SO ser atingido e nenhum arquivo poder ser aberto.

Como mitigar

Use blocos try-finally ou defer (em Go) para garantir liberação mesmo em caso de erro. Em C++/Java, prefira RAII e garbage collection. Implemente análise estática e testes de vazamento com ferramentas como Valgrind, AddressSanitizer ou verificadores de SonarQube.

CVE-2024-20481MEDIUMA vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeEPSS 15.9%KEVCVE-2021-42340—DoS via memory leak with WebSocket connectionsEPSS 11.8%CVE-2019-3883MEDIUMIn 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocEPSS 8.4%CVE-2019-19956HIGHxmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.EPSS 5.5%CVE-2019-3821HIGHA flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could EPSS 2.9%CVE-2018-20622MEDIUMJasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used.EPSS 2.9%CVE-2022-26353—A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unEPSS 2.7%CVE-2024-49769HIGHWaitress has a denial of service leading to high CPU usage/resource exhaustionEPSS 1.4%CVE-2021-1523HIGHCisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service VulnerabilityEPSS 1.3%CVE-2022-29884—A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/EPSS 1.2%CVE-2024-41888MEDIUMApache Answer: The link for resetting user password is not Single-UseEPSS 1.2%CVE-2024-41890MEDIUMApache Answer: The link to reset the user's password will remain valid after sending a new linkEPSS 1.1%CVE-2024-1300MEDIUMIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportEPSS 1.1%CVE-2021-34581HIGHWAGO: Denial of Service vulnerability inside the OpenSSL implementationEPSS 1.0%CVE-2021-31378MEDIUMJunos OS: An attacker sending spoofed RADIUS messages to a Junos OS device configured for broadband services may cause broadband subscribers to remain stuck in a "Terminating" state.EPSS 1.0%CVE-2021-21002HIGHDenial of Service in Phoenix Contact FL COMSERVER UNI productsEPSS 1.0%CVE-2023-1150HIGHWAGO: Series 750-3x/-8x prone to MODBUS server DoSEPSS 0.9%CVE-2022-22170HIGHJunos OS: Specific packets over VXLAN cause FPC memory leak and ultimately resetEPSS 0.9%CVE-2025-24120HIGHThis issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VEPSS 0.9%CVE-2021-21600MEDIUMDell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentEPSS 0.8%