2092 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.
CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 2092 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.