Skip to content
OpenAdvisories

Weakness (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

Variant Draft

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How to prevent it (3 mitigations)

  1. Implementation

    Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.

    For example, glibc in Linux provides protection against free of invalid pointers.

    When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].

    To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

  2. Architecture and Design

    Use an abstraction library to abstract away risky APIs. Not a complete solution.

  3. Architecture and Design, Build and Compilation

    Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

Source: MITRE CWE-401

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-67183 Public exploit

    TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

    TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute() to allocate Url objects, HttpHeaders objects,…

    GeneralSandman TinyWeb
  • High 7.5
    CVE-2026-56819 Public exploit

    Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame i…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 6.3
    CVE-2026-22024 Public exploit

    CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion

    CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the …

    nasa CryptoLib
  • High 7.5
    CVE-2025-53020 Public exploit

    Apache HTTP Server: HTTP/2 DoS by Memory Increase

    Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2022-25479 Public exploit

    Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer dri…

  • Low 3.3
    CVE-2023-26083 Exploited Public exploit

    Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifros…

    KEV Apr 7, 2023
  • High 8.8
    CVE-2021-3492 Public exploit

    Ubuntu linux kernel shiftfs file system double free vulnerability

    Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could u…

    Ubuntu Linux kernel linux-raspi2 linux-hwe Linux Ubuntu