目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-400 未加控制的资源消耗(资源穷尽) 类漏洞列表 1802

CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1802 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。

MITRE CWE 官方描述
CWE：CWE-400 不受控的资源消耗 (Uncontrolled Resource Consumption) 英文：该产品未正确控制有限资源的分配和维护。
常见影响 (2)
Availability DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding envir…
Access Control, Other Bypass Protection Mechanism, Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
缓解措施 (4)
Architecture and Design Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perha…
Architecture and Design Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to preven…
Architecture and Design Ensure that protocols have specific limits of scale placed on them.
Implementation Ensure that all failures in resource allocation place the system into a safe posture.
代码示例 (2)
The following example demonstrates the weakness.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }
Bad · Java
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-25762 @adonisjs/lucid 安全漏洞 — core 7.5 High 2026-02-06
CVE-2026-25579 Navidrome 安全漏洞 — navidrome 6.5AI Medium AI 2026-02-04
CVE-2026-25140 apko 资源管理错误漏洞 — apko 7.5 High 2026-02-04
CVE-2026-25122 apko 资源管理错误漏洞 — apko 5.5 Medium 2026-02-04
CVE-2026-22228 TP-Link Archer BE230 安全漏洞 — Archer BE230 v1.2 4.4AI Medium AI 2026-02-03
CVE-2026-0599 Text Generation Inference 资源管理错误漏洞 — huggingface/text-generation-inference 7.5AI High AI 2026-02-02
CVE-2025-7105 LibreChat 资源管理错误漏洞 — danny-avila/librechat 7.5AI High AI 2026-02-02
CVE-2025-6208 LlamaIndex 资源管理错误漏洞 — run-llama/llama_index 7.5 - 2026-02-02
CVE-2026-22259 Suricata 安全漏洞 — suricata 7.5 High 2026-01-27
CVE-2026-22258 Suricata 安全漏洞 — suricata 7.5 High 2026-01-27
CVE-2025-55102 Eclipse ThreadX NetX Duo 安全漏洞 — Eclipse ThreadX - NetX Duo 7.5AI High AI 2026-01-27
CVE-2026-24001 jsdiff 安全漏洞 — jsdiff 7.5AI High AI 2026-01-22
CVE-2026-20080 Cisco IEC6400 Wireless Backhaul Edge Compute Software 资源管理错误漏洞 — Cisco Ultra-Reliable Wireless Backhaul 5.3 Medium 2026-01-21
CVE-2025-9283 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9282 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9281 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9280 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9279 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9278 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 6.5AI Medium AI 2026-01-20
CVE-2025-9466 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9465 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2025-9464 Rockwell Automation ArmorStart LT 安全漏洞 — ArmorStart® LT 7.5AI High AI 2026-01-20
CVE-2026-1174 prime 安全漏洞 — prime 5.3 Medium 2026-01-19
CVE-2026-21696 Wings 资源管理错误漏洞 — wings 7.1AI High AI 2026-01-19
CVE-2025-69199 Pterodactyl Panel 安全漏洞 — panel 7.5AI High AI 2026-01-19
CVE-2025-69198 Pterodactyl Panel 安全漏洞 — panel 6.5AI Medium AI 2026-01-19
CVE-2026-23842 ChatterBot 资源管理错误漏洞 — ChatterBot 7.5 High 2026-01-19
CVE-2025-15532 Open5GS 安全漏洞 — Open5GS 5.3 Medium 2026-01-17
CVE-2026-0992 libxml2 资源管理错误漏洞 — Red Hat Hardened Images 2.9 Low 2026-01-15
CVE-2026-22239 Bluspark BLUVOYIX 安全漏洞 — BLUVOYIX 7.2AI High AI 2026-01-14

CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1802 条 CVE 漏洞。