Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
An event listener is registered unconditionally on an object's signal after a conditional check that reuses existing instances. When refreshing an existing cached entry, this repeatedly registers listeners on the reused signal, leading to memory leaks and denial of service.
Breaking out of the zero-copy Tx batch loop upon encountering an invalid descriptor without draining multi-buffer fragments or reclaiming invalid descriptors causes descriptor leakage and ring desynchronization.
A deferred Promise is created with only a `resolve` handler and stored into a tracking collection or map. If the corresponding HTTP request or WebSocket handshake fails or aborts, the Promise will remain pending indefinitely and the request object in the map will not be cleaned up, leading to memory leaks and DoS.
Message delivery handling invokes a listener without catching exceptions to release unacknowledged deliveries and replenish AMQP link credits, leading to credit starvation.
Storing per-request state in a Map keyed by `HttpContext` can lead to an unbounded memory leak when asynchronous requests fail, time out, or abort before response interceptors execute. Store request-scoped state directly on `HttpContext` using `setAttribute` and `removeAttribute`.
Unmanaged `Flux.interval` subscription detected. `Flux.interval` produces an infinite sequence on a background scheduler; calling `.subscribe()` without retaining the returned `Disposable` or bounding the interval will leak background threads/timers indefinitely, leading to resource exhaustion (DoS).
A vector is declared, populated, and then drained for manual cleanup entirely within an async block. If the async block contains early returns (like `?`), the manual cleanup loop may be bypassed, leading to resource leaks. Consider declaring the vector outside the async block and performing the cleanup after the async block has resolved.
Returning NET_OK after calling eth_bridge_handle_locally() incorrectly signals to the network stack that the packet buffer was consumed. If no L3 handler claims it, the net_pkt RX buffer will never be freed, causing memory leak and denial of service. The actual net_verdict from eth_bridge_handle_locally() must be returned instead.
