CWE-772: Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
A kind of CWE-404 Improper Resource Shutdown or Release.
From the CWE List. © The MITRE Corporation.
Newest
- devolutions server Improper release of expired privileged access checkouts in the PAM scheduled check-in task in... 8.8 High
- freerdp FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE 5.3 Medium
- eclipse foundation threadx NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool 8.7 High
- progress software ws ftp server Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server 5.3 Medium
- rt-labs p-net Resource exhaustion from RPC sessions kept for requests to unknown interface 8.7 High
- rt-labs p-net Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness 8.7 High
- zephyrproject zephyr Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity 4.3 Medium
- labstack echo Echo: WebSocket proxy can retain connections and handlers after client disconnect 8.2 High
- red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 more Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 3.3 Low
- eclipse foundation threadx Deleting a user-mode module thread leaks its privileged kernel stack 6.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd 5.9 Medium
- modelcontextprotocol python-sdk MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion 6.9 Medium
- the libreswan project libreswan Denial of Service via sending bogus X.509 certificates 3.7 Low
- zephyrproject zephyr Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses 5.7 Medium
- ibm virtualization management interface IBM Power Systems Firmware Denial of Service 4.5 Medium
- zephyrproject zephyr Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure 6.5 Medium
- zephyrproject zephyr Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update 6.5 Medium
- illumos illumos-gate, omnios +1 more Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory 6.8 Medium
- corazawaf coraza OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor 5.3 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early 7.5 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 more Sssd: sssd: denial of service via race condition in autofs responder 4.7 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Sssd: sssd: denial of service via memory exhaustion in kcm responder 5.5 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 more Sssd: sssd: denial of service via memory exhaustion in autofs responder 5.5 Medium
- apache software foundation thrift Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error 8.2 High
- apache software foundation thrift Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path 8.7 High
- eclipse foundation threadx netx duo NULL Pointer Dereference on MSRP Attribute Table Exhaustion 7.1 High
- wind river vxworks 7 VxWorks 7 Memory Resource leak 5.5 Medium
- linux, linux kernel +1 more usb: typec: ucsi: unregister debugfs entries on teardown 5.5 Medium
- apache software foundation tomcat Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout 7.5 High
- vllm vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders 6.9 Medium
- apache software foundation karaf Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching 7.5 High
- asynchttpclient async-http-client AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service 5.9 Medium
- internlm lmdeploy InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch 8.7 High
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software +1 more Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service Vulnerability 8.6 High
- modelcontextprotocol rust-sdk RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service 7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability 4.7 Medium
- erlang otp httpd parks a request worker indefinitely on a malformed chunk size sent after the headers 8.7 High
- erlang otp httpd applies no timeout while receiving a request body, parking a worker on a stalled client 8.7 High
- spring amqp, vmware spring advanced message queuing protocol +1 more In Spring AMQP the link credit never replenished on listener exception path 6.5 Medium
- libp2p js-libp2p libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion 7.5 High
- apache cloudstack Apache CloudStack: DoS caused by database connections leak 6.8 Medium
- nodejs undici undici vulnerable to Denial of Service via orphaned RetryHandler response body 5.9 Medium
- coturn The coturn server can end in a state where it does not accept more requests with "even-port" enabled. 7.1 High
- zephyrproject zephyr Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS 3.7 Low
- legion of the bouncy castle inc. bc-fja Zeroisation of sensitive key material on garbage collection relies on finalization 8.7 High
- cisco ios xe software, ios xe +1 more Cisco IOS XE Software SNMP Denial of Service Vulnerability 7.7 High
- eclipse milo In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception... 6.9 Medium
- apache httpclient, apache software foundation httpcomponents client +1 more Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS 5.3 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 8 +1 more +3 more Rhcs: memory leak during https connection leads to denial of service 5.3 Medium
- nlnet labs unbound Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration 5.9 Medium
- Show olderLoading…