CWE-401Missing Release of Memory after Effective Lifetime

Description

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Common consequences

• Availability→DoS: Crash, Exit, or Restart,DoS: Instability,DoS: Resource Consumption (CPU),DoS: Resource Consumption (Memory)
  Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advan
• Other→Reduce Performance

Potential mitigations

• Implementation
  [object Object]
• Architecture and Design
  Use an abstraction library to abstract away risky APIs. Not a complete solution.
• Architecture and Design,Build and Compilation
  Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

Related CWEs

Recent CVEs classified under this CWE