Weaknesses of type CWE-404

624 results

Liberação ou encerramento impróprio de recursos

Acontece quando a aplicação não libera adequadamente recursos (memória, conexões de banco de dados, arquivos abertos, sockets) após seu uso, deixando-os presos. Isso causa vazamento de recursos: a aplicação consome cada vez mais memória ou conexões até ficar indisponível ou travar.

Example

Um serviço web abre uma conexão com o banco de dados para cada requisição, mas em caso de erro não fecha a conexão no bloco finally ou com try-with-resources. Após milhares de requisições falhadas, o pool de conexões se esgota e novas requisições começam a falhar.

How to mitigate

Use try-with-resources (Java), context managers (Python), ou finally blocks para garantir liberação mesmo em caso de exceção. Implemente testes de carga e monitore vazamento de recursos em produção com ferramentas APM.

CVE-2022-44267MEDIUMImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waEPSS 76.6%CVE-2018-8120HIGHAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k EPSS 73.7%KEVCVE-2018-8639HIGHAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k EPSS 22.3%KEVCVE-2023-3206MEDIUMChengdu VEC40G denial of serviceEPSS 18.7%CVE-2025-1103HIGHD-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereferenceEPSS 13.0%CVE-2024-12342HIGHTP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of serviceEPSS 8.9%CVE-2022-25762—Response mix-up with WebSocket concurrent send and closeEPSS 8.4%CVE-2022-2591HIGHTEM FLEX-1085 reboot denial of serviceEPSS 8.2%CVE-2025-8761HIGHINSTAR 2K+/4K Backend IPC Server denial of serviceEPSS 6.9%CVE-2024-0546MEDIUMEasyFTP LIST Command denial of serviceEPSS 6.8%CVE-2018-19591HIGHIn the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation oEPSS 5.5%CVE-2018-8611HIGHAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaEPSS 4.2%KEVCVE-2024-0737MEDIUMXlightftpd Xlight FTP Server Login denial of serviceEPSS 4.2%CVE-2025-15229MEDIUMTenda CH22 DhcpListClient fromDhcpListClient denial of serviceEPSS 4.0%CVE-2024-0725MEDIUMProSSHD denial of serviceEPSS 3.6%CVE-2024-0723MEDIUMfreeSSHd denial of serviceEPSS 3.6%CVE-2018-8836—Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 waEPSS 3.6%CVE-2025-48989HIGHApache Tomcat: h2 DoS - Made You ResetEPSS 3.5%CVE-2025-8671HIGHCVE-2025-8671EPSS 3.5%CVE-2018-8405HIGHAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "EPSS 3.4%KEV