CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1802 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-10932 | Progress MOVEit Transfer 资源管理错误漏洞 — MOVEit Transfer | 8.2 | High | 2025-10-29 |
| CVE-2025-62260 | Liferay Portal和Liferay DXP 资源管理错误漏洞 — Portal | 7.5AI | High AI | 2025-10-27 |
| CVE-2025-12194 | Bouncy Castle Java 安全漏洞 — Bouncy Castle for Java FIPS | 7.5 | - | 2025-10-24 |
| CVE-2025-62706 | Authlib 安全漏洞 — authlib | 6.5 | Medium | 2025-10-22 |
| CVE-2025-59043 | OpenBao 资源管理错误漏洞 — openbao | 7.5 | High | 2025-10-17 |
| CVE-2025-33177 | NVIDIA Jetson Linux和NVIDIA IGX OS 资源管理错误漏洞 — Jetson Orin Series | 5.5 | Medium | 2025-10-14 |
| CVE-2025-59502 | Microsoft Windows Remote Procedure Call Runtime 资源管理错误漏洞 — Windows 10 Version 1809 | 7.5 | High | 2025-10-14 |
| CVE-2025-11635 | Tomofun Furbo 360 安全漏洞 — Furbo 360 | 4.3 | Medium | 2025-10-12 |
| CVE-2025-61919 | Rack 资源管理错误漏洞 — rack | 7.5 | High | 2025-10-10 |
| CVE-2025-59975 | Juniper Networks Junos Space 资源管理错误漏洞 — Junos Space | 7.5 | High | 2025-10-09 |
| CVE-2025-52961 | Juniper Networks Junos OS Evolved 资源管理错误漏洞 — Junos OS Evolved | 6.5 | Medium | 2025-10-09 |
| CVE-2025-61772 | Rack 资源管理错误漏洞 — rack | 7.5 | High | 2025-10-07 |
| CVE-2025-61771 | Rack 资源管理错误漏洞 — rack | 7.5 | High | 2025-10-07 |
| CVE-2025-61770 | Rack 资源管理错误漏洞 — rack | 7.5 | High | 2025-10-07 |
| CVE-2025-52867 | QNAP Qsync Central 安全漏洞 — Qsync Central | 7.5 | - | 2025-10-03 |
| CVE-2025-61600 | Stalwart 安全漏洞 — stalwart | 7.5 | High | 2025-10-02 |
| CVE-2025-61595 | Mantrachain 安全漏洞 — mantrachain | 5.3AI | Medium AI | 2025-10-02 |
| CVE-2025-20370 | Splunk Cloud Platform和Splunk Enterprise 资源管理错误漏洞 — Splunk Enterprise | 4.9 | Medium | 2025-10-01 |
| CVE-2025-11149 | node-static 安全漏洞 — node-static | 7.5 | High | 2025-09-30 |
| CVE-2025-59830 | Rack 安全漏洞 — rack | 7.5 | High | 2025-09-25 |
| CVE-2025-6921 | transformers 资源管理错误漏洞 — huggingface/transformers | 7.5 | - | 2025-09-23 |
| CVE-2025-4444 | Tor 安全漏洞 — Tor | 3.7 | Low | 2025-09-18 |
| CVE-2025-58767 | REXML 资源管理错误漏洞 — rexml | 7.5AI | High AI | 2025-09-17 |
| CVE-2025-35432 | CISA Thorium 安全漏洞 — Thorium | 5.3 | Medium | 2025-09-17 |
| CVE-2025-43796 | Liferay Portal和Liferay DXP 资源管理错误漏洞 — Portal | 7.5 | - | 2025-09-12 |
| CVE-2025-59139 | Hono 安全漏洞 — hono | 5.3 | Medium | 2025-09-12 |
| CVE-2025-48040 | Erlang/OTP 安全漏洞 — OTP | 6.9 | Medium | 2025-09-11 |
| CVE-2025-20340 | Cisco IOS XR 资源管理错误漏洞 — Cisco IOS XR Software | 7.4 | High | 2025-09-10 |
| CVE-2025-49460 | Zoom Workplace 安全漏洞 — Zoom Workplace Clients | 4.3 | Medium | 2025-09-09 |
| CVE-2025-40802 | Siemens RUGGEDCOM RST2428P 资源管理错误漏洞 — RUGGEDCOM RST2428P | 3.1 | Low | 2025-09-09 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1802 条 CVE 漏洞。