CWE-401: Memory Leak vulnerabilities

CVE-2026-70065 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions affecting the DHCP Server component. It involves a missing release of memory after its effective lifetime, which can be exploited by an unauthorized attacker to cause a denial of service (DoS) over the network. The issue has been officially fixed in specific updated versions of affected Windows builds.

CVE-2026-69588 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving a missing release of memory after its effective lifetime in the TCP/IP stack. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network by exhausting system memory resources. The issue affects multiple Windows 11 builds prior to their respective fixed versions. Microsoft has issued official fixes for all affected versions.

CVE-2026-16028 is a memory exhaustion vulnerability in Protocol::HTTP2 for Perl versions before 1.14. The issue arises because closed streams are not fully removed from the connection stream table, causing memory to accumulate indefinitely during a connection's lifetime. This can lead to significant memory growth on the server when many streams are opened and closed sequentially.

CVE-2026-18313 is a medium severity vulnerability in libpcap's rpcapd component where memory allocated for certain client messages is never freed, causing a memory leak. This leak occurs during normal use and can be accelerated by a malicious client sending specific requests. The issue affects libpcap versions from 1.9.0 up to but not including 1.10.7. There is no indication of confidentiality or integrity impact, only availability degradation due to memory exhaustion.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. This issue affects smartLink HW-PN: from 1.04 before 1.10.

CVE-2026-47888 is a high severity vulnerability in the Spring Framework that causes a memory leak when a malformed SETUP frame is processed by a Spring RSocket application. It affects multiple versions of the Spring Framework from 5.2.0.RELEASE through 7.0.8. The vulnerability is classified as CWE-401, indicating missing release of memory after its effective lifetime. There is no vendor advisory or patch information available at this time.

CVE-2026-59295 is a medium severity vulnerability in Spring Micrometer where outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service condition due to an unbounded memory leak. This issue affects multiple versions of Micrometer including 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and all versions up to 1.9.18. The vulnerability is classified under CWE-401, indicating missing release of memory after its effective lifetime. No patch or remediation details are provided in the available data.

CVE-2026-52734 is a medium severity vulnerability in ZcashFoundation's zebra node software prior to version 4.5.0. It involves a memory leak caused by the mempool download pipeline retaining transactions after a timeout due to missing cleanup of timed-out entries. This leads to monotonic memory growth under sustained traffic, potentially causing node degradation or termination by the operating system. The issue is fixed in zebra version 4.5.0.

A memory leak vulnerability exists in honojs node-server versions prior to 2.0.10. When a WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header is sent to an upgradeWebSocket route, the IncomingMessage object is retained indefinitely due to a missing cleanup path. This allows an unauthenticated attacker to cause unbounded memory growth and potentially make the service unavailable. The issue is fixed in version 2.0.10.

CVE-2026-54876 is a memory leak vulnerability in OpenSSL versions 4.0.0 and 3.6.0 affecting TLS clients that enable OCSP response checking. A malicious TLS server can send an OCSP response with no single response entries, causing the client to leak memory during certificate chain verification. This can lead to denial of service by exhausting memory over repeated connections. The vulnerability does not affect OpenSSL FIPS modules and OCSP checking is not enabled by default.

Eclipse Milo versions 0.6.0 through 1.1.4 contain a vulnerability in the UASC server transport handlers where partial message chunks are not released upon channel disconnection. This allows a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially causing the server to terminate.

CVE-2026-67430 is a medium severity vulnerability in the MCP Ruby SDK prior to version 0.23.0. The issue involves the MCP::Server::Transports::StreamableHTTPTransport component not expiring sessions by default, causing unbounded retention of ServerSession objects. This can lead to memory exhaustion in the process due to repeated initialize requests. The vulnerability is fixed in version 0.23.0.

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6-byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the full allocation leaked on every error path. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2n_alloc zeroes the existing pointer before allocating new memory, causing the first allocation to be leaked. This can occur during normal QUIC traffic when a client offers a key share group the server does not prefer. An unauthenticated user can amplify the issue by deliberately forcing HelloRetryRequests, causing up to approximately 64 KB of unreachable memory per handshake. Over time, this can lead to increased memory consumption on long-running server processes. The unreachable memory is only reclaimed when the process is restarted. Only server-side QUIC-enabled deployments are affected. Non-QUIC TLS connections are not affected. We recommend you upgrade s2n-tls to version v1.7.6

NVIDIA Triton Inference Server for Linux has a vulnerability involving missing release of memory after its effective lifetime, which can lead to denial of service. This issue is identified as CWE-401 and affects version 0.0. The vulnerability has a high severity with a CVSS score of 7.5. No patch or official remediation has been confirmed yet.

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart. The leak can be monitored by watching the continuous increase of the buffer values in the output of: user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2-S4, * 24.4 versions before 24.4R2.