CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1802 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-58369 | FS2 资源管理错误漏洞 — fs2 | 5.3 | Medium | 2025-09-05 |
| CVE-2025-43772 | Liferay Portal和Liferay DXP 资源管理错误漏洞 — Portal | 9.1AI | Critical AI | 2025-09-04 |
| CVE-2025-58157 | gnark 资源管理错误漏洞 — gnark | 7.5 | High | 2025-08-29 |
| CVE-2025-29898 | QNAP Qsync Central 安全漏洞 — Qsync Central | 7.5 | - | 2025-08-29 |
| CVE-2025-9341 | Bouncy Castle 安全漏洞 — Bouncy Castle for Java FIPS | 7.5AI | High AI | 2025-08-22 |
| CVE-2025-57751 | pyLoad 资源管理错误漏洞 — pyload | 6.5AI | Medium AI | 2025-08-21 |
| CVE-2025-48956 | vLLM 资源管理错误漏洞 — vllm | 7.5 | High | 2025-08-21 |
| CVE-2025-5115 | Eclipse Jetty 安全漏洞 — Eclipse Jetty | 7.5AI | High AI | 2025-08-20 |
| CVE-2025-8449 | Schneider Electric多款产品 资源管理错误漏洞 — EcoStruxure Building Operation Enterprise Server | 6.5AI | Medium AI | 2025-08-20 |
| CVE-2025-9092 | Bouncy Castle Java 安全漏洞 — Bouncy Castle for Java - BC-FJA 2.1.0 | 7.5AI | High AI | 2025-08-16 |
| CVE-2025-54472 | Apache bRPC 安全漏洞 — Apache bRPC | 7.5AI | High AI | 2025-08-14 |
| CVE-2025-55197 | pypdf 安全漏洞 — pypdf | 6.5AI | Medium AI | 2025-08-13 |
| CVE-2025-53722 | Microsoft Windows Remote Desktop Services 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-08-12 |
| CVE-2025-40766 | Siemens SINEC Traffic Analyzer 资源管理错误漏洞 — SINEC Traffic Analyzer | 5.5 | Medium | 2025-08-12 |
| CVE-2025-55152 | oak 安全漏洞 — oak | 5.3 | Medium | 2025-08-09 |
| CVE-2025-54884 | Vision UI 安全漏洞 — Vision-ui | 7.5AI | High AI | 2025-08-05 |
| CVE-2025-54796 | Copyparty 安全漏洞 — copyparty | 7.5 | High | 2025-08-01 |
| CVE-2025-53012 | MaterialX 资源管理错误漏洞 — MaterialX | 7.5 | - | 2025-08-01 |
| CVE-2025-54575 | ImageSharp 安全漏洞 — ImageSharp | 5.3 | Medium | 2025-07-30 |
| CVE-2025-54572 | Ruby SAML 安全漏洞 — ruby-saml | 7.5AI | High AI | 2025-07-30 |
| CVE-2025-41677 | MB Connect Line mbNET.mini 资源管理错误漏洞 — mbNET.mini | 4.9 | Medium | 2025-07-21 |
| CVE-2025-41676 | MB Connect Line mbNET.mini 资源管理错误漏洞 — mbNET.mini | 4.9 | Medium | 2025-07-21 |
| CVE-2025-50057 | RSJoomla! RSFiles! component for Joomla 资源管理错误漏洞 — RSFiles! component for Joomla | 7.5 | - | 2025-07-18 |
| CVE-2025-53893 | FileBrowser 安全漏洞 — filebrowser | 6.5AI | Medium AI | 2025-07-15 |
| CVE-2025-48795 | Apache CXF 资源管理错误漏洞 — Apache CXF | 5.5 | - | 2025-07-15 |
| CVE-2025-53636 | Osc Open OnDemand 安全漏洞 — ondemand | 5.4 | Medium | 2025-07-11 |
| CVE-2025-53506 | Apache Tomcat 资源管理错误漏洞 — Apache Tomcat | 7.5 | - | 2025-07-10 |
| CVE-2025-53371 | DiscordNotifications 代码问题漏洞 — DiscordNotifications | 9.1 | Critical | 2025-07-10 |
| CVE-2025-49722 | Microsoft Windows Print Spooler Components 资源管理错误漏洞 — Windows 10 Version 1507 | 5.7 | Medium | 2025-07-08 |
| CVE-2025-49716 | Microsoft Windows Netlogon 资源管理错误漏洞 — Windows Server 2008 R2 Service Pack 1 | 7.5 | High | 2025-07-08 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1802 条 CVE 漏洞。