CWE-772— Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.— MITRE CWE catalog

584 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-772page 11 of 12

CVE-2017-14930MEDIUMCVSS 5.5EG 5.5
2017-09-30
Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
CVE-2017-14431MEDIUMCVSS 5.5EG 5.5
2017-09-13
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, a…
CVE-2017-0726MEDIUMCVSS 5.5EG 5.5
2017-08-09
A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36389123.
CVE-2017-0697MEDIUMCVSS 5.5EG 5.5
2017-07-06
A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37239013.
CVE-2017-8421MEDIUMCVSS 5.5EG 5.5
2017-05-02
The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE fil…
CVE-2017-7624MEDIUMCVSS 5.5EG 5.5
2017-04-10
The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file.
CVE-2017-7594MEDIUMCVSS 5.5EG 5.5
2017-04-09
The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.
CVE-2017-6499MEDIUMCVSS 5.5EG 5.5
2017-03-06
An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS).
CVE-2024-1300MEDIUMCVSS 5.4EG 5.4
2024-04-02
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL con…
CVE-2026-90870MEDIUMCVSS 5.3EG 5.3
2026-10-29
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
CVE-2026-107834MEDIUMCVSS 5.3EG 5.3
2026-10-09
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temp…
CVE-2026-94625MEDIUMCVSS 5.3EG 5.3
2026-09-21
vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender t…
CVE-2026-64607MEDIUMCVSS 5.3EG 5.3
2026-07-31
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note …
CVE-2026-12353MEDIUMCVSS 5.3EG 5.3
2026-07-23
An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to resta…
CVE-2026-40209MEDIUMCVSS 5.3EG 5.3
2026-06-25
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit t…
CVE-2026-21874MEDIUMCVSS 5.3EG 5.3
2026-01-08
NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connect…
CVE-2023-32255MEDIUMCVSS 5.3EG 5.3
2025-08-02
A flaw was found in the Linux kernel's ksmbd component. A memory leak can occur if a client sends a session setup request with an unknown NTLMSSP message type, potentially leading to resource exhaustion.
CVE-2024-20493MEDIUMCVSS 5.3EG 5.3
2024-10-23
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote att…
CVE-2024-41890MEDIUMCVSS 5.3EG 5.3
2024-08-12
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity per…
CVE-2024-41888MEDIUMCVSS 5.3EG 5.3
2024-08-12
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link remains valid within its expiration period even after it has been used. This co…
CVE-2023-31274MEDIUMCVSS 5.3EG 5.3
2024-01-18
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of ne…
CVE-2023-45814MEDIUMCVSS 5.3EG 5.3
2023-10-18
Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundSh…
CVE-2020-5924MEDIUMCVSS 5.3EG 5.3
2020-08-26
In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set.
CVE-2018-3658MEDIUMCVSS 5.3EG 5.3
2018-09-12
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.
CVE-2017-1786MEDIUMCVSS 5.3EG 5.3
2018-04-23
IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all resources due to a memory leak resulting in service loss. IBM X-Force ID: 136975.
CVE-2018-10205MEDIUMCVSS 5.3EG 5.3
2018-04-19
hyperstart 1.0.0 in HyperHQ Hyper has memory leaks in the container_setup_modules and hyper_rescan_scsi functions in container.c, related to runV 1.0.0 for Docker.
CVE-2018-6957MEDIUMCVSS 5.3EG 5.3
2018-03-15
VMware Workstation (14.x before 14.1.1, 12.x) and Fusion (10.x before 10.1.1 and 8.x) contain a denial-of-service vulnerability which can be triggered by opening a large number of VNC sessions. Note: In order for exploitation to be possibl…
CVE-2017-17296MEDIUMCVSS 5.3EG 5.3
2018-02-15
Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R00…
CVE-2017-17164MEDIUMCVSS 5.3EG 5.3
2018-02-15
Huawei Secospace AntiDDoS8000 V500R001C20SPC500 have a memory leak vulnerability due to memory don't be released when the system open some function. An attacker could exploit it to cause memory leak, which may further lead to system except…
CVE-2017-15332MEDIUMCVSS 5.3EG 5.3
2018-02-15
Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R00…
CVE-2017-6599MEDIUMCVSS 5.3EG 5.3
2017-04-07
A vulnerability in Google-defined remote procedure call (gRPC) handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash due to a system memory leak, resu…
CVE-2025-54983MEDIUMCVSS 5.2EG 5.2
2025-11-12
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.
CVE-2021-47389MEDIUMCVSS 5.1EG 5.1
2024-05-21
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: fix missing sev_decommission in sev_receive_start DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIV…
CVE-2026-54786MEDIUMCVSS 5.0EG 5.0
2026-07-01
Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 whic…
CVE-2015-6700MEDIUMCVSS v2 5.0EG 5.0
2015-10-14
The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows …
CVE-2009-5039MEDIUMCVSS v2 5.0EG 5.0
2011-01-07
Memory leak in the gk_circuit_info_do_in_acf function in the H.323 implementation in Cisco IOS before 15.0(1)XA allows remote attackers to cause a denial of service (memory consumption) via a large number of calls over a long duration, as …
CVE-2003-0132MEDIUMCVSS v2 5.0EG 5.0
2003-04-11
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
CVE-2021-0132MEDIUMCVSS 4.9EG 4.9
2021-06-09
Missing release of resource after effective lifetime in an API for the Intel(R) Security Library before version 3.3 may allow a privileged user to potentially enable denial of service via network access.
CVE-2020-1883MEDIUMCVSS 4.9EG 4.9
2020-06-05
Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability …
CVE-2009-3519MEDIUMCVSS v2 4.9EG 4.9
2009-10-01
Multiple memory leaks in the IP module in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_109, allow local users to cause a denial of service (memory consumption) via vectors related to (1) M_DATA, (2) M_PROTO, (3) M_PCP…
CVE-2026-104045MEDIUMCVSS 4.7EG 4.7
2026-10-06
A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enum…
CVE-2022-45887MEDIUMCVSS 4.7EG 4.7
2022-11-25
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.
CVE-2019-20794MEDIUMCVSS 4.7EG 4.7
2020-05-09
An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the users…
CVE-2019-16994MEDIUMCVSS 4.7EG 4.7
2019-09-30
In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a.
CVE-2017-3803MEDIUMCVSS 4.7EG 4.7
2017-01-26
A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attacker to cause a memory leak in the software forwarding queue that would eventually lead to a partial …
CVE-2026-16678MEDIUMCVSS 4.5EG 4.5
2026-10-12
IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to imprope…
CVE-2022-31222MEDIUMCVSS 2.3EG 4.4
2022-09-12
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the applica…
CVE-2026-121391MEDIUMCVSS 4.3EG 4.3
2026-11-03
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can …
CVE-2026-81039MEDIUMCVSS 4.3EG 4.3
2026-10-26
The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_start_add_conn() in subsys/bluetooth/host/adv.c. When an incoming peripheral con…
CVE-2025-14969MEDIUMCVSS 4.3EG 4.3
2026-01-26
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. This action may lead to leaking connections from the database connection po…

Map vulnerabilities like CWE-772 to your infrastructure

EchelonGraph correlates every CVE — across CWE-772 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →