CWE-401— Missing Release of Memory after Effective Lifetime (Memory Leak)

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.— MITRE CWE catalog

2,075 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-401page 5 of 42

CVE-2024-39549HIGHCVSS 7.5EG 7.5
2024-07-11
A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memo…
CVE-2024-3382HIGHCVSS 7.5EG 7.5
2024-04-10
A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 S…
CVE-2024-1394HIGHCVSS 7.5EG 7.5
2024-03-21
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rs…
CVE-2023-33086HIGHCVSS 7.5EG 7.5
2024-03-04
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
CVE-2023-33084HIGHCVSS 7.5EG 7.5
2024-03-04
Transient DOS while processing IE fragments from server during DTLS handshake.
CVE-2024-24148HIGHCVSS 7.5EG 7.5
2024-02-28
A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
CVE-2024-27508HIGHCVSS 7.5EG 7.5
2024-02-27
Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.
CVE-2024-27507HIGHCVSS 7.5EG 7.5
2024-02-27
libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.
CVE-2023-33049HIGHCVSS 7.5EG 7.5
2024-02-06
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
CVE-2024-24267HIGHCVSS 7.5EG 7.5
2024-02-05
gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.
CVE-2024-24265HIGHCVSS 7.5EG 7.5
2024-02-05
gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.
CVE-2024-24259HIGHCVSS 7.5EG 7.5
2024-02-05
freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.
CVE-2024-24258HIGHCVSS 7.5EG 7.5
2024-02-05
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.
CVE-2024-22563HIGHCVSS 7.5EG 7.5
2024-01-19
openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.
CVE-2024-21611HIGHCVSS 7.5EG 7.5
2024-01-12
A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS)…
CVE-2023-0248HIGHCVSS 7.5EG 7.5
2023-12-14
An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.
CVE-2023-38380HIGHCVSS 7.5EG 7.5
2023-12-12
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions)…
CVE-2023-41102HIGHCVSS 7.5EG 7.5
2023-11-17
An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available mem…
CVE-2023-5954HIGHCVSS 7.5EG 7.5
2023-11-09
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.…
CVE-2023-44192HIGHCVSS 7.5EG 7.5
2023-10-13
An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause memory leak, leading to Denial of Service (DoS). On all Junos OS QFX5000 S…
CVE-2023-36435HIGHCVSS 7.5EG 7.5
2023-10-10
Microsoft QUIC Denial of Service Vulnerability
CVE-2023-40534HIGHCVSS 7.5EG 7.5
2023-10-10
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM…
CVE-2023-5156HIGHCVSS 7.5EG 7.5
2023-09-25
A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.
CVE-2023-28366HIGHCVSS 7.5EG 7.5
2023-09-01
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because …
CVE-2023-4513HIGHCVSS 7.5EG 7.5
2023-08-24
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
CVE-2023-32247HIGHCVSS 7.5EG 7.5
2023-07-24
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An atta…
CVE-2023-31517HIGHCVSS 7.5EG 7.5
2023-05-23
A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted file.
CVE-2023-29163HIGHCVSS 7.5EG 7.5
2023-05-03
When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not eva…
CVE-2023-28982HIGHCVSS 7.5EG 7.5
2023-04-17
A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a …
CVE-2023-30637HIGHCVSS 7.5EG 7.5
2023-04-13
Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server. NOTE: installations with brpc-0.14.0 and later are unaffected.
CVE-2023-26257HIGHCVSS 7.5EG 7.5
2023-02-27
An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.
CVE-2023-25566HIGHCVSS 7.5EG 7.5
2023-02-14
GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a usern…
CVE-2022-45920HIGHCVSS 7.5EG 7.5
2023-01-26
In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak.
CVE-2023-22417HIGHCVSS 7.5EG 7.5
2023-01-13
A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In an IPsec VPN envi…
CVE-2023-22410HIGHCVSS 7.5EG 7.5
2023-01-13
A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Networks Junos OS on MX Series platforms with MPC10/MPC11 line cards, allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). Devices…
CVE-2022-4743HIGHCVSS 7.5EG 7.5
2023-01-12
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x …
CVE-2022-47941HIGHCVSS 7.5EG 7.5
2022-12-23
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.
CVE-2022-43272HIGHCVSS 7.5EG 7.5
2022-12-02
DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.
CVE-2021-46854HIGHCVSS 7.5EG 7.5
2022-11-23
mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.
CVE-2022-43223HIGHCVSS 7.5EG 7.5
2022-11-01
open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted UE attachment.
CVE-2022-43222HIGHCVSS 7.5EG 7.5
2022-11-01
open5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PFCP packet.
CVE-2022-43221HIGHCVSS 7.5EG 7.5
2022-11-01
open5gs v2.4.11 was discovered to contain a memory leak in the component src/upf/pfcp-path.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PFCP packet.
CVE-2022-41832HIGHCVSS 7.5EG 7.5
2022-10-19
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase…
CVE-2022-41624HIGHCVSS 7.5EG 7.5
2022-10-19
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase…
CVE-2022-2963HIGHCVSS 7.5EG 7.5
2022-10-14
A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentation fault.
CVE-2022-38371HIGHCVSS 7.5EG 7.5
2022-10-11
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BA…
CVE-2022-41556HIGHCVSS 7.5EG 7.5
2022-10-06
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/…
CVE-2022-38178HIGHCVSS 7.5EG 7.5
2022-09-21
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVE-2022-38177HIGHCVSS 7.5EG 7.5
2022-09-21
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVE-2022-2906HIGHCVSS 7.5EG 7.5
2022-09-21
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

Map vulnerabilities like CWE-401 to your infrastructure

EchelonGraph correlates every CVE — across CWE-401 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →