CWE-401
Missing Release of Memory after Effective Lifetime
Description
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (1,881)
page 88 of 95| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-16318 | Med | 0.00 | 5.3 | 0.00 | Jul 21, 2026 | The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second… | ||
| CVE-2026-47482 | Hig | 0.00 | 7.5 | 0.00 | Jul 14, 2026 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service. | ||
| CVE-2026-44806 | Med | 0.00 | 5.3 | 0.01 | Jul 14, 2026 | Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. | ||
| CVE-2026-57027 | Med | 0.00 | 6.5 | 0.00 | Jul 9, 2026 | A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a… | ||
| CVE-2026-10699 | Hig | 0.00 | 7.5 | 0.00 | Jul 8, 2026 | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1. | ||
| CVE-2026-50254 | Hig | 0.00 | 7.5 | 0.00 | Jun 30, 2026 | An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator… | ||
| CVE-2026-35505 | Hig | 0.00 | 7.5 | 0.00 | Jun 30, 2026 | An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart. | ||
| CVE-2026-13474 | Hig | 0.00 | 7.5 | 0.00 | Jun 30, 2026 | Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler | ||
| CVE-2026-53429 | Med | 0.00 | — | 0.00 | Jun 29, 2026 | Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered document to cause a denial of service through unbounded native memory exhaustion. The native rendering code permanently leaks memory… | ||
| CVE-2026-22025 | Low | 0.00 | 3.7 | 0.01 | Jan 10, 2026 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, when the KMC server… | ||
| CVE-2026-22024 | Med | 0.00 | 5.3 | 0.00 | Jan 10, 2026 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the… | ||
| CVE-2026-21674 | Low | 0.00 | 3.3 | 0.00 | Jan 6, 2026 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1. | ||
| CVE-2025-50951 | Med | 0.00 | 6.5 | 0.00 | Oct 23, 2025 | FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. | ||
| CVE-2025-50949 | Med | 0.00 | 6.5 | 0.00 | Oct 23, 2025 | FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. | ||
| CVE-2025-60361 | Low | 0.00 | 3.3 | 0.00 | Oct 17, 2025 | radare2 v5.9.8 and before contains a memory leak in the function bochs_open. | ||
| CVE-2025-60360 | Med | 0.00 | 5.5 | 0.00 | Oct 17, 2025 | radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init. | ||
| CVE-2025-60359 | Med | 0.00 | 5.5 | 0.00 | Oct 17, 2025 | radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new. | ||
| CVE-2025-60358 | Med | 0.00 | 5.5 | 0.00 | Oct 16, 2025 | radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations. | ||
| CVE-2025-54939 | Med | 0.00 | 5.3 | 0.01 | Aug 1, 2025 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. | ||
| CVE-2025-53537 | Hig | 0.00 | 7.5 | 0.00 | Jul 23, 2025 | LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml… |
- risk 0.00cvss 5.3epss 0.00
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second…
- risk 0.00cvss 7.5epss 0.00
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.
- risk 0.00cvss 5.3epss 0.01
Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
- risk 0.00cvss 6.5epss 0.00
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a…
- risk 0.00cvss 7.5epss 0.00
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- risk 0.00cvss 7.5epss 0.00
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator…
- risk 0.00cvss 7.5epss 0.00
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
- risk 0.00cvss 7.5epss 0.00
Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler
- risk 0.00cvss —epss 0.00
Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered document to cause a denial of service through unbounded native memory exhaustion. The native rendering code permanently leaks memory…
- risk 0.00cvss 3.7epss 0.01
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, when the KMC server…
- risk 0.00cvss 5.3epss 0.00
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the…
- risk 0.00cvss 3.3epss 0.00
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.
- risk 0.00cvss 6.5epss 0.00
FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.
- risk 0.00cvss 6.5epss 0.00
FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
- risk 0.00cvss 3.3epss 0.00
radare2 v5.9.8 and before contains a memory leak in the function bochs_open.
- risk 0.00cvss 5.5epss 0.00
radare2 v5.9.8 and before contains a memory leak in the function r2r_subprocess_init.
- risk 0.00cvss 5.5epss 0.00
radare2 v5.9.8 and before contains a memory leak in the function r_bin_object_new.
- risk 0.00cvss 5.5epss 0.00
radare2 v.5.9.8 and before contains a memory leak in the function _load_relocations.
- risk 0.00cvss 5.3epss 0.01
LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.
- risk 0.00cvss 7.5epss 0.00
LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml…