Falhas do tipo CWE-401

619 resultados

Fuga de memória - liberação não realizada após uso

Ocorre quando o código aloca memória (heap ou recursos) mas falha em liberá-la quando não é mais necessária. A memória fica presa no processo, reduzindo gradualmente a memória disponível até causar degradação de performance ou crash. É especialmente crítico em serviços que rodam indefinidamente (daemons, APIs, servidores).

Exemplo

Um servidor web que processa requisições sem liberar buffers de conexão fechada. Após milhares de requisições, acumula KB/MB de lixo na memória. Ou uma função que abre arquivo/socket e retorna sem chamar close() em todos os caminhos possíveis (incluindo exceções).

Como mitigar

Use padrões como RAII (Resource Acquisition Is Initialization) em C++, try-finally ou context managers em Python/Java, ou verificadores de vazamento (valgrind, AddressSanitizer). Revise especialmente blocos de exceção e retornos prematuros. Testes de longa duração ajudam a detectar fugas acumulativas.

CVE-2022-20785HIGHClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022EPSS 7.0%CVE-2022-47941HIGHAn issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_EPSS 4.9%CVE-2025-53020HIGHApache HTTP Server: HTTP/2 DoS by Memory IncreaseEPSS 4.6%CVE-2019-20388HIGHxmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.EPSS 4.3%CVE-2023-32247HIGHSession setup memory exhaustion denial-of-service vulnerabilityEPSS 3.9%CVE-2022-1012—A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flawEPSS 3.9%CVE-2017-15094—An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when pEPSS 3.3%CVE-2020-25672—A memory leak vulnerability was found in Linux kernel in llcp_sock_connectEPSS 3.1%CVE-2019-14818HIGHA flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a EPSS 2.8%CVE-2022-38177HIGHMemory leak in ECDSA DNSSEC verification codeEPSS 2.6%CVE-2022-38178HIGHMemory leaks in EdDSA DNSSEC verification codeEPSS 2.5%CVE-2020-25644—A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attackeEPSS 2.4%CVE-2020-35502—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy iEPSS 2.4%CVE-2021-20210—A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can leEPSS 2.4%CVE-2021-20215—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to EPSS 2.3%CVE-2017-7654—In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can sendEPSS 2.2%CVE-2021-20211—A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.EPSS 2.1%CVE-2021-20214—A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memorEPSS 2.0%CVE-2021-20212—A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcrEPSS 2.0%CVE-2022-24756HIGHMissing Release of Memory after Effective Lifetime in Bareos DirectorEPSS 1.9%