Fallos del tipo CWE-772

92 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2023-36533HIGHUncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network accEPSS 0.8%CVE-2023-47124MEDIUMDenial of service whith ACME HTTPChallenge in TraefikEPSS 0.8%CVE-2025-3864LOWConnection pool exhaustion in hackneyEPSS 0.7%CVE-2026-3104HIGHMemory leak in code preparing DNSSEC proofs of non-existenceEPSS 0.7%CVE-2024-28882MEDIUMOpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the valiEPSS 0.7%CVE-2026-2359HIGHMulter vulnerable to Denial of Service via resource exhaustionEPSS 0.7%CVE-2023-20095HIGHA vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDEPSS 0.6%CVE-2026-1605HIGHIn Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with EPSS 0.6%CVE-2026-39830CRITICALInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshEPSS 0.6%CVE-2026-21720HIGHUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outEPSS 0.6%CVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.6%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.6%CVE-2024-35821HIGHubifs: Set page uptodate in the correct placeEPSS 0.6%CVE-2024-52303HIGHaiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodEPSS 0.6%CVE-2024-10396MEDIUMFileserver crash and possible information leak on StoreACL/FetchACLEPSS 0.6%CVE-2024-20493MEDIUMA vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) SoEPSS 0.5%CVE-2026-26999HIGHTraefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS)EPSS 0.5%CVE-2023-22302MEDIUMBIG-IP HTTP profile vulnerabilityEPSS 0.5%CVE-2026-21874MEDIUMNiceGUI has Redis connection leak via tab storage causes service degradationEPSS 0.5%CVE-2024-21789HIGHBIG-IP ASM and Advanced WAF vulnerabilityEPSS 0.5%