CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1801 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-20058 | F5 BIG-IP 资源管理错误漏洞 — BIG-IP | 7.5 | High | 2025-02-05 |
| CVE-2025-21087 | F5 BIG-IP 资源管理错误漏洞 — BIG-IP | 7.5 | High | 2025-02-05 |
| CVE-2024-53851 | Discourse 资源管理错误漏洞 — discourse | 4.3 | Medium | 2025-02-04 |
| CVE-2024-12345 | INW Krbyyyzo 资源管理错误漏洞 — Krbyyyzo | 4.4 | Medium | 2025-01-27 |
| CVE-2025-0704 | update 资源管理错误漏洞 — bootplus | 5.3 | Medium | 2025-01-24 |
| CVE-2024-53299 | Apache Wicket 资源管理错误漏洞 — Apache Wicket | 7.5 | - | 2025-01-23 |
| CVE-2025-23184 | Apache CXF 资源管理错误漏洞 — Apache CXF | 5.9 | Medium | 2025-01-21 |
| CVE-2025-21218 | Microsoft Windows Kerberos 资源管理错误漏洞 — Windows Server 2012 | 7.5 | High | 2025-01-14 |
| CVE-2025-21300 | Microsoft Windows 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21231 | Microsoft IP Helper 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21207 | Microsoft Windows 资源管理错误漏洞 — Windows 10 Version 1809 | 7.5 | High | 2025-01-14 |
| CVE-2025-21330 | Microsoft Windows Remote Desktop Services 资源管理错误漏洞 — Windows 10 Version 1809 | 7.5 | High | 2025-01-14 |
| CVE-2025-21389 | Microsoft Windows UPnP 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21289 | Microsoft Message Queuing 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21290 | Microsoft Message Queuing 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21270 | Microsoft Message Queuing 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2025-21251 | Microsoft Message Queuing 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2025-01-14 |
| CVE-2024-47239 | Dell PowerScale OneFS 资源管理错误漏洞 — PowerScale OneFS | 6.5 | Medium | 2025-01-08 |
| CVE-2024-55605 | Suricata 资源管理错误漏洞 — suricata | 7.5 | High | 2025-01-06 |
| CVE-2025-21614 | go-git 安全漏洞 — go-git | 7.5 | High | 2025-01-06 |
| CVE-2024-53647 | Trend Micro ID Security 安全漏洞 — Trend Micro ID Security | 6.5 | Medium | 2024-12-31 |
| CVE-2024-56200 | Altair 资源管理错误漏洞 — altair | 8.6 | High | 2024-12-19 |
| CVE-2022-27600 | QNAP多款产品 信任管理问题漏洞 — QTS | 6.8 | Medium | 2024-12-19 |
| CVE-2024-12698 | Red Hat OpenShift 资源管理错误漏洞 | 6.5 | Medium | 2024-12-18 |
| CVE-2024-54677 | Apache Tomcat 安全漏洞 — Apache Tomcat | 7.5 | - | 2024-12-17 |
| CVE-2024-12601 | WordPress plugin Calculated Fields Form 资源管理错误漏洞 — Calculated Fields Form | 5.3 | Medium | 2024-12-17 |
| CVE-2024-11835 | PlexTrac 安全漏洞 — PlexTrac | 7.5 | - | 2024-12-13 |
| CVE-2024-12579 | WordPress plugin Minify HTML 资源管理错误漏洞 — Minify HTML | 5.3 | Medium | 2024-12-13 |
| CVE-2024-54113 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 6.5 | Medium | 2024-12-12 |
| CVE-2024-49075 | Microsoft Windows Remote Desktop Services 资源管理错误漏洞 — Windows 10 Version 1809 | 7.5 | High | 2024-12-10 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1801 条 CVE 漏洞。