Fallos del tipo CWE-772

89 resultados

Falha em liberar recurso após seu ciclo de vida

Ocorre quando o código aloca um recurso (memória, arquivo, conexão, handle) mas não o libera adequadamente ao fim de seu uso. O recurso permanece consumido, esgotando gradualmente a capacidade do sistema — característica típica de vazamento de recursos. É perigoso porque leva a negação de serviço, travamento da aplicação ou consumo desenfreado de memória/descritores.

Ejemplo

Uma função abre uma conexão com banco de dados em caso de sucesso, mas quando ocorre uma exceção antes do `close()`, a conexão nunca é liberada. Em loops ou requisições frequentes, o pool de conexões se esgota e novas operações falham.

Cómo mitigar

Use padrões de garantia de limpeza: `try-finally`, `try-with-resources` (Java), context managers (Python), ou RAII em C++. Revise todo caminho de código (incluindo exceções e retornos antecipados) para garantir que cada recurso alocado tenha seu ponto de liberação correspondente.

CVE-2026-61387MEDIUMIn Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an uncheckeEPSS 0.3%CVE-2026-20124HIGHCisco IOS XE Software SNMP Denial of Service VulnerabilityEPSS 0.3%CVE-2025-65947HIGHthread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOSEPSS 0.3%CVE-2026-13351HIGHnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsEPSS 0.3%CVE-2025-62723MEDIUMFlashMQ does not release memory of queued QoS messagesEPSS 0.3%CVE-2026-39455HIGHBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2025-36071MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-40209MEDIUMDenial of service via IXFR queriesEPSS 0.3%CVE-2022-45887MEDIUMAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of EPSS 0.3%CVE-2022-28187MEDIUMNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management softwareEPSS 0.3%CVE-2026-41637LOWDegradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queriesEPSS 0.3%CVE-2023-22996MEDIUMIn the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with pEPSS 0.3%CVE-2026-12353MEDIUMRhcs: memory leak during https connection leads to denial of serviceEPSS 0.3%CVE-2026-64607MEDIUMApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSEPSS 0.2%CVE-2026-56444MEDIUMDegradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configurationEPSS 0.2%CVE-2026-9156MEDIUMTanium addressed a denial of service vulnerability in Tanium Server.EPSS 0.2%CVE-2026-54786LOWWasmtime: Leak in WASIp1 `fd_renumber` implementationEPSS 0.2%CVE-2021-47389MEDIUMKVM: SVM: fix missing sev_decommission in sev_receive_startEPSS 0.2%CVE-2024-53074MEDIUMwifi: iwlwifi: mvm: don't leak a link on AP removalEPSS 0.2%CVE-2025-61670LOWWasmtime has memory leak in C API with `externref` and `anyref` typesEPSS 0.2%