Fallos del tipo CWE-772

93 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2025-36128HIGHIBM MQ denial of serviceEPSS 0.5%CVE-2023-31274MEDIUMMissing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server EPSS 0.5%CVE-2026-32874HIGHUltraJSON has a Memory Leak parsing large integers allows DoSEPSS 0.5%CVE-2023-32255MEDIUMKernel: memory leak via ksmbd session setup request with unknown ntlmssp message typeEPSS 0.5%CVE-2023-45814MEDIUMTokens cached in the AuthenticationService are susceptible to reuse in BunkumEPSS 0.4%CVE-2024-39562HIGHJunos OS Evolved: A high rate of SSH connections causes a Denial of ServiceEPSS 0.4%CVE-2020-14339—A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows EPSS 0.4%CVE-2026-20082HIGHA vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software couldEPSS 0.4%CVE-2026-42577HIGHNetty: epoll transport denial of service via RST on half-closed TCP connectionEPSS 0.4%CVE-2025-22891HIGHBIG-IP PEM VulnerabilityEPSS 0.4%CVE-2026-36590HIGHAn issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c componEPSS 0.4%CVE-2025-27421HIGHGoroutine Leak in Abacus SSE ImplementationEPSS 0.4%CVE-2025-30256HIGHA denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted serieEPSS 0.4%CVE-2022-26354—A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing EPSS 0.4%CVE-2020-27351LOWVarious memory and file descriptor leaks in apt-pythonEPSS 0.4%CVE-2025-14969MEDIUMHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectEPSS 0.4%CVE-2022-22155MEDIUMJunos OS: ACX5448: FPC memory leak due to IPv6 neighbor flapsEPSS 0.4%CVE-2026-2261HIGHblocklistd(8) socket leakEPSS 0.4%CVE-2026-35227HIGHImproper resource management in CODESYS Modbus TCP ServerEPSS 0.4%CVE-2026-15713MEDIUMLibsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leakEPSS 0.3%