CWE-401— Missing Release of Memory after Effective Lifetime (Memory Leak)

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.— MITRE CWE catalog

2,036 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-401page 6 of 41

CVE-2021-33645HIGHCVSS 7.5EG 7.5
2022-08-10
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
CVE-2022-34568HIGHCVSS 7.5EG 7.5
2022-07-28
SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
CVE-2022-22209HIGHCVSS 7.5EG 7.5
2022-07-20
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause a Denial of Service (DoS). On all Junos platforms, the Kernel Routing T…
CVE-2022-22205HIGHCVSS 7.5EG 7.5
2022-07-20
A Missing Release of Memory after Effective Lifetime vulnerability in the Application Quality of Experience (appqoe) subsystem of the PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated network based attacker to cause …
CVE-2021-41690HIGHCVSS 7.5EG 7.5
2022-06-28
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a m…
CVE-2021-41687HIGHCVSS 7.5EG 7.5
2022-06-28
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker ca…
CVE-2022-33105HIGHCVSS 7.5EG 7.5
2022-06-23
Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
CVE-2021-41490HIGHCVSS 7.5EG 7.5
2022-06-17
Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.
CVE-2021-35078HIGHCVSS 7.5EG 7.5
2022-06-14
Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra…
CVE-2018-17240HIGHCVSS 7.5EG 7.5
2022-06-10
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration (e.g., username and password).
CVE-2022-29693HIGHCVSS 7.5EG 7.5
2022-06-02
Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
CVE-2022-29932HIGHCVSS 7.5EG 7.5
2022-05-11
The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request.
CVE-2022-20785HIGHCVSS 7.5EG 7.5
2022-05-04
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104…
CVE-2022-28487HIGHCVSS 7.5EG 7.5
2022-05-04
Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality.
CVE-2021-42218HIGHCVSS 7.5EG 7.5
2022-05-03
OMPL v1.5.2 contains a memory leak in VFRRT.cpp
CVE-2021-41959HIGHCVSS 7.5EG 7.5
2022-05-03
JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, which causes a memory leak.
CVE-2022-24756HIGHCVSS 7.5EG 7.5
2022-03-15
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentica…
CVE-2022-0853HIGHCVSS 7.5EG 7.5
2022-03-11
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
CVE-2021-40047HIGHCVSS 7.5EG 7.5
2022-03-10
There is a vulnerability of memory not being released after effective lifetime in the Bastet module. Successful exploitation of this vulnerability may affect integrity.
CVE-2020-22844HIGHCVSS 7.5EG 7.5
2022-02-28
A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.
CVE-2022-22336HIGHCVSS 7.5EG 7.5
2022-02-23
IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395.
CVE-2021-46082HIGHCVSS 7.5EG 7.5
2022-02-18
Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted …
CVE-2021-37205HIGHCVSS 7.5EG 7.5
2022-02-09
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family…
CVE-2022-22174HIGHCVSS 7.5EG 7.5
2022-01-19
A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) co…
CVE-2022-22173HIGHCVSS 7.5EG 7.5
2022-01-19
A Missing Release of Memory after Effective Lifetime vulnerability in the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS). In a scenario whe…
CVE-2021-44542HIGHCVSS 7.5EG 7.5
2021-12-23
A memory leak vulnerability was found in Privoxy when handling errors.
CVE-2021-44541HIGHCVSS 7.5EG 7.5
2021-12-23
A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.
CVE-2021-44540HIGHCVSS 7.5EG 7.5
2021-12-23
A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.
CVE-2021-37046HIGHCVSS 7.5EG 7.5
2021-12-07
There is a Memory leak vulnerability with the codec detection module in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart due to memory exhaustion.
CVE-2020-23876HIGHCVSS 7.5EG 7.5
2021-11-10
pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.
CVE-2021-34598HIGHCVSS 7.5EG 7.5
2021-11-10
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active
CVE-2021-36993HIGHCVSS 7.5EG 7.5
2021-10-28
There is a Memory leaks vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability.
CVE-2021-40114HIGHCVSS 7.5EG 7.5
2021-10-27
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. T…
CVE-2021-34792HIGHCVSS 7.5EG 7.5
2021-10-27
A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff…
CVE-2021-30844HIGHCVSS 7.5EG 7.5
2021-10-19
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A remote attacker may be able to leak memory.
CVE-2020-20665HIGHCVSS 7.5EG 7.5
2021-09-30
rudp v0.6 was discovered to contain a memory leak in the component main.c.
CVE-2021-39176HIGHCVSS 7.5EG 7.5
2021-08-31
detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not released. The problem has been patched in detect-character-encoding v0.3.1.
CVE-2021-39282HIGHCVSS 7.5EG 7.5
2021-08-18
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
CVE-2020-22650HIGHCVSS 7.5EG 7.5
2021-07-19
A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a large number of alarm events.
CVE-2021-20108HIGHCVSS 7.5EG 7.5
2021-07-19
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 90…
CVE-2021-20237HIGHCVSS 7.5EG 7.5
2021-05-28
An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE…
CVE-2021-28651HIGHCVSS 7.5EG 7.5
2021-05-27
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is a…
CVE-2021-20209HIGHCVSS 7.5EG 7.5
2021-05-25
A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.
CVE-2020-25672HIGHCVSS 7.5EG 7.5
2021-05-25
A memory leak vulnerability was found in Linux kernel in llcp_sock_connect
CVE-2020-20451HIGHCVSS 7.5EG 7.5
2021-05-25
Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.
CVE-2021-32032HIGHCVSS 7.5EG 7.5
2021-05-21
In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abort() operation in the associated cryptographic library from freeing internal reso…
CVE-2021-27386HIGHCVSS 7.5EG 7.5
2021-05-12
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16…
CVE-2021-28665HIGHCVSS 7.5EG 7.5
2021-05-06
Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memory and CPU resources, and possibly a denial of service.
CVE-2021-0230HIGHCVSS 7.5EG 7.5
2021-04-22
On Juniper Networks SRX Series devices with link aggregation (lag) configured, executing any operation that fetches Aggregated Ethernet (AE) interface statistics, including but not limited to SNMP GET requests, causes a slow kernel memory …
CVE-2020-11255HIGHCVSS 7.5EG 7.5
2021-04-07
Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is freed and rest of the memory is leaked in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu…

Map vulnerabilities like CWE-401 to your infrastructure

EchelonGraph correlates every CVE — across CWE-401 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →