Weakness (CWE)
CWE-401: Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
How to prevent it (3 mitigations)
-
Implementation
Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
For example, glibc in Linux provides protection against free of invalid pointers.
When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Architecture and Design, Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
Source: MITRE CWE-401
449 results · Clear filters · Feed
-
Medium 4.7
FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to pars…
-
Medium 4.7
FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding
FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_decode_sof() in libavcodec/mjpegdec.c, which overwrites the hwaccel_picture_private pointer without freeing it. Attackers can supply crafted MJPEG streams with repeated SOF markers or faili…
-
Medium 4.7
FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vdpau.c that allows attackers to exhaust heap memory by aborting pictures before end_frame. Attackers can supply crafted H.264 streams with malformed NAL units that repeatedly abandon pic…
-
Medium 5.5
FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper
FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpegxs_dec_decode() in libsvtjpegxsdec.c that leaks decoder instances when ff_set_dimensions() rejects frame dimensions. Attackers can supply a crafted JPEG XS stream, for example in MPEG-TS, …
-
Medium 4.7
FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame
FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the VP9 decoder that allows attackers to exhaust memory because vp9_decode_frame() skips resetting the CBS fragment on error paths. Attackers can supply a crafted VP9 stream with invalid tile si…
-
Medium 5.5
FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never frees the rpu.payload allocated by ff_dovi_rpu_generate(). Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU all…
-
Medium 5.5
FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1_decode_frame()
FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit …
-
Medium 5.5
FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper
FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only pa…
-
Medium 6.5
Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subs…
-
Medium 6.5
Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service
The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() and mbedtls_aead(), every error path after a successful psa_cipher_encrypt_setup() / psa_aead_decrypt_setup() returned di…
-
Medium 5.3
QuickJS-NG before 0.16.0 Memory Leak via Atomics.store
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or…
-
Medium 5.3
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhausti…
-
Medium 5.3
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak,…
-
Medium 5.3
ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks tha…
-
Medium 5.8
Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…
-
Medium 5.7
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on hf->tx_pending when the RFCOMM DLC goes down. hfp_hf_disconnected() only cancelled the work items and c…
-
Medium 6.5
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax err…
-
Medium 5.3
Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved on QFX5K-family platforms allows a configured EVPN peer to cause a denial of service through memory exhaustion vi…
-
Medium 6.5
Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane …
-
Medium 6.5
Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present
A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP featu…
-
Medium 5.3
NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthen…
-
Medium 5.3
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder …
-
Medium 6.5
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reach…
-
Medium 6.5
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notifi…
-
Medium 6.5
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awa…
-
Medium 5.3
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reu…
-
Medium 5.3
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_ite…
-
Medium 6.3
Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back
Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
Medium 5.5
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could …
-
Medium 5.5
Missing Release of Memory after Effective Lifetime in Wireshark
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
-
Medium 5.5
VxWorks 7 Memory allocation
In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09
-
Medium 5.5
VxWorks Memory Allocation
Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 2…
-
Medium 6.5
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted…
-
Medium 5.9
Suricata smb: some SMB flows can cause resource exhaustion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction,…
-
Medium 6.5
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents A…
-
Medium 5.3
Dvidelabs flatcc semantics.c fb_clear_parser memory leak
A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has b…
-
Medium 5.3
Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service
The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name buffer (and, for read, a data buffer) via k_malloc() when…
-
Medium 6.5
Windows DHCP Client Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
-
Medium 6.5
Windows DHCP Server Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over a network.
-
Medium 5.7
Windows DHCP Server Denial of Service Vulnerability
Missing release of memory after effective lifetime in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.