CWE-772
CVEs classified under CWE-772, newest first.
319 CVEsRSS
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-81039Medium· 4.3Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity
The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in le_adv_start_add_conn() in subsys/bluetooth/host/adv.c. When an incoming peripheral c…
CVE-2026-116146Low· 3.7ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedl…
CVE-2026-116155Medium· 5.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leadin…
CVE-2026-116150Low· 3.1ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, cau…
CVE-2026-116154Medium· 5.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML dat…
CVE-2026-116152Medium· 5.3ImageMagick: ImageMagick: Denial of Service via memory leak in MAT decoder (CVE-2026-116152)
A flaw was found in ImageMagick. An attacker could exploit this issue by providing a specially crafted MAT image file that triggers an error-handling path where allocated memory is not properly released. Over time, repeated processing of t…
CVE-2026-116151Low· 3.7ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak me…
CVE-2026-116157Low· 3.3ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locati…
CVE-2026-116156Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, …
CVE-2026-116159Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl opt…
CVE-2026-116158Low· 2.5ImageMagick before 7.1.2-33 Memory Leak in magick compare
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memo…
GHSA-9969-6676-49h5HighEcho: WebSocket proxy can retain connections and handlers after client disconnect
Echo: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-114236Low· 3.3Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
CVE-2026-111879Medium· 5.5perl-DBI: perl-DBI: Denial of Service via unreleased table lock on error (CVE-2026-111879)
A flaw was found in perl-DBI. When creating or opening a database table in the DBD::DBM module fails due to an error, an exclusive file lock acquired during initialization is not properly released. A user or attacker who can control connec…
CVE-2026-95108Medium· 6.8Deleting a user-mode module thread leaks its privileged kernel stack
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_cr…
CVE-2026-111064High· 7.5aiohttp: aiohttp: Denial of Service via missing initial request timeout (CVE-2026-111064)
A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhaustin…
CVE-2026-98746Low· 2.3kernel: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (CVE-2026-98746)
A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service (DoS) through resource exhaustion. The driver fails to release clock references during probe error handling or when the…
CVE-2026-98779Low· 1.9kernel: drm/amdgpu: fix ACP MFD device leak on init failure (CVE-2026-98779)
A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. During Audio CoProcessor (ACP) hardware initialization, child multi-function devices are not properly released if a power domain attachment fails or a hardware reset times out…
CVE-2026-98777Low· 3.3kernel: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede (CVE-2026-98777)
A flaw was found in the Linux kernel's Android Binder inter-process communication (IPC) driver. When an asynchronous transaction supersedes an earlier pending transaction in a frozen process, the kernel frees the outdated transaction witho…
CVE-2026-98782Low· 2.3kernel: drm/mediatek: Fix ovl adaptor platform device leak (CVE-2026-98782)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When device initialization fails or during driver removal, the driver fails to unregister an allocated overlay adaptor platform device. A local user cou…
CVE-2026-98780Low· 1.9kernel: drm/amdgpu: fix IP instance memory leak on kobject add failure (CVE-2026-98780)
A flaw was found in the Linux kernel's AMD GPU driver. When registering hardware discovery entries within the sysfs (system filesystem) interface, the driver fails to release allocated memory if a kernel object fails to register. An unexpe…
CVE-2026-98784Low· 2.3drm/amdgpu/gfx6: fix firmware leak on teardown
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking the firmwar…
CVE-2026-98789Medium· 4.4kernel: bpf: Fix objects stuck in free_by_rcu_ttrace (CVE-2026-98789)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) memory allocator. When releasing memory, objects queued while a delayed cleanup cycle is already in progress can fail to be reclaimed. A local user can exploit this vulner…
CVE-2026-98811Low· 3.3kernel: net/sched: cls_api: reclaim an empty proto on the error path (CVE-2026-98811)
A flaw was found in the Linux kernel's network traffic control classifier subsystem. A local attacker with network administration privileges could exploit a race condition by submitting concurrent filter addition requests that fail during …
CVE-2026-98820Medium· 5.5kernel: blk-mq: set RQF_USE_SCHED when the operation is known (CVE-2026-98820)
A flaw was found in the Linux kernel's block multi-queue (blk-mq) subsystem. When cached input/output (I/O) requests originally allocated for passthrough commands are reused for standard read or write operations, scheduler flags are not pr…
CVE-2026-98831Low· 2.3kernel: of/overlay: don't leak fragment references when changeset init fails (CVE-2026-98831)
A flaw was found in the Linux kernel's Device Tree overlay subsystem. This flaw allows a local user to cause a Denial of Service (DoS) through memory exhaustion. When an overlay changeset fails during target or symbol lookup, the kernel fa…
CVE-2026-98435Medium· 4.4kernel: EDAC/altera: Use parent device for devres in altr_portb_setup() (CVE-2026-98435)
A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. Device-managed interrupt requests and resource groups in the altr_portb_setup() function were improperly associated with a temporary per-port devic…
CVE-2026-98433Low· 2.5kernel: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (CVE-2026-98433)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and intern…
CVE-2026-98451Low· 3.3⚖ disputedkernel: smb: client: use finish_no_open() for non-regular inodes (CVE-2026-98451)
A flaw was found in the Linux kernel's SMB client. A local user can trigger this issue by opening an existing symbolic link or non-regular file on an SMB mount using file creation flags. Because the client improperly handles non-regular fi…