Missing Release of Memory after Effective Lifetime
CWE-401
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
We track 207 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
- Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Architecture and Design Build and Compilation: Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
Latest Missing Release of Memory after Effective Lifetime vulnerabilities
- 7.5 High severity
Kernel: Missing Release of Memory after Effective Lifetime
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
- 7.5 High severity
bareos: Missing Release of Memory after Effective Lifetime
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a smal
- 7.5 High severity
jboss-client: Missing Release of Memory after Effective Lifetime
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
- 7.5 High severity
Sterling Secure Proxy: Missing Release of Memory after Effective Lifetime
IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395.
- 7.5 High severity
Junos OS: Missing Release of Memory after Effective Lifetime
A vulnerability in the processing of inbound IPv6 packets in Juniper Networks Junos OS on QFX5000 Series and EX4600 switches may cause the memory to not be freed, leading to a packet DMA memory leak, and eventual Denial of Service (DoS) condition. Once the con
- 7.5 High severity
Junos OS: Missing Release of Memory after Effective Lifetime
A Missing Release of Memory after Effective Lifetime vulnerability in the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS). In a scenario where Public Key Infrast
- 8.6 High severity
Cisco IOS and XE Software Internet Key Exchange Memory Leak Exploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (Do