CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1801 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-49129 | Microsoft Windows Remote Desktop Gateway 资源管理错误漏洞 — Windows Server 2012 | 7.5 | High | 2024-12-10 |
| CVE-2024-49096 | Microsoft Message Queuing 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2024-12-10 |
| CVE-2024-42426 | Dell PowerScale OneFS 资源管理错误漏洞 — PowerScale OneFS | 4.3 | Medium | 2024-12-09 |
| CVE-2024-12254 | Python 安全漏洞 — CPython | 8.7 | High | 2024-12-06 |
| CVE-2024-11498 | LibJXL 安全漏洞 — libjxl | 6.5 | - | 2024-11-25 |
| CVE-2024-52804 | Tornado 安全漏洞 — tornado | 7.5 | High | 2024-11-22 |
| CVE-2024-45420 | Zoom多款产品 安全漏洞 — Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers | 4.3 | Medium | 2024-11-19 |
| CVE-2023-39180 | Linux kernel 安全漏洞 | 4.0 | Medium | 2024-11-18 |
| CVE-2024-52520 | Nextcloud 资源管理错误漏洞 — security-advisories | 5.7 | Medium | 2024-11-15 |
| CVE-2023-20125 | Cisco BroadWorks 资源管理错误漏洞 — Cisco BroadWorks | 8.6 | High | 2024-11-15 |
| CVE-2024-48989 | Bosch Rexroth IndraDrive 安全漏洞 — IndraDrive FWA-INDRV*-MP* | 7.5 | High | 2024-11-13 |
| CVE-2024-9409 | Schneider Electric多款产品 资源管理错误漏洞 — PowerLogic PM5320 | 7.5 | High | 2024-11-13 |
| CVE-2024-47535 | Netty 资源管理错误漏洞 — netty | 5.5 | Medium | 2024-11-12 |
| CVE-2024-46891 | Siemens SINEC INS 资源管理错误漏洞 — SINEC INS | 5.3 | Medium | 2024-11-12 |
| CVE-2024-10314 | Perforce Helix Core 资源管理错误漏洞 — Helix Core | 7.5AI | High AI | 2024-11-11 |
| CVE-2024-10344 | Perforce Helix Core 资源管理错误漏洞 — Helix Core | 7.5AI | High AI | 2024-11-11 |
| CVE-2024-10345 | Perforce Helix Core 资源管理错误漏洞 — Helix Core | 7.5AI | High AI | 2024-11-11 |
| CVE-2024-51513 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 5.5 | Medium | 2024-11-05 |
| CVE-2024-10599 | TONGDA Office Anywhere 资源管理错误漏洞 — OA 2017 | 5.3 | Medium | 2024-10-31 |
| CVE-2024-50354 | gnark 安全漏洞 — gnark | 5.5 | Medium | 2024-10-31 |
| CVE-2024-31152 | LevelOne WBR-6012 安全漏洞 — WBR-6012 | 5.3 | Medium | 2024-10-30 |
| CVE-2024-49767 | Werkzeug 安全漏洞 — werkzeug | 7.5 | - | 2024-10-25 |
| CVE-2024-20526 | Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 5.3 | Medium | 2024-10-23 |
| CVE-2024-20351 | Cisco Firepower Threat Defense和Cisco FirePOWER Services 安全漏洞 — Cisco Firepower Threat Defense Software | 8.6 | High | 2024-10-23 |
| CVE-2024-21536 | http-proxy-middleware 安全漏洞 — http-proxy-middleware | 7.5 | High | 2024-10-19 |
| CVE-2024-45736 | Splunk Enterprise和Splunk Cloud Platform 安全漏洞 — Splunk Enterprise | 6.5 | Medium | 2024-10-14 |
| CVE-2024-8184 | Eclipse Jetty 安全漏洞 — Jetty | 5.9 | Medium | 2024-10-14 |
| CVE-2024-6762 | Eclipse Jetty 安全漏洞 — Jetty | 3.1 | Low | 2024-10-14 |
| CVE-2024-9823 | Eclipse Jetty 安全漏洞 — Jetty | 5.3 | Medium | 2024-10-14 |
| CVE-2024-47497 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | High | 2024-10-11 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1801 条 CVE 漏洞。