CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1801 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-7294 | Progress Software Telerik Report Server 资源管理错误漏洞 — Telerik Report Server | 7.5 | High | 2024-10-09 |
| CVE-2024-43575 | Microsoft Hyper-V 资源管理错误漏洞 — Windows Server 2016 | 7.5 | High | 2024-10-08 |
| CVE-2024-43545 | Microsoft Windows Online Certificate Status Protocol 资源管理错误漏洞 — Windows Server 2008 Service Pack 2 | 7.5 | High | 2024-10-08 |
| CVE-2024-43544 | Microsoft Simple Certificate Enrollment Protocol 资源管理错误漏洞 — Windows Server 2008 Service Pack 2 | 7.5 | High | 2024-10-08 |
| CVE-2024-38149 | Microsoft BranchCache 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2024-10-08 |
| CVE-2024-43541 | Microsoft Simple Certificate Enrollment Protocol 资源管理错误漏洞 — Windows Server 2008 Service Pack 2 | 7.5 | High | 2024-10-08 |
| CVE-2024-43515 | Microsoft Internet Small Computer Systems Interface 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2024-10-08 |
| CVE-2024-43506 | Microsoft BranchCache 资源管理错误漏洞 — Windows 10 Version 1507 | 7.5 | High | 2024-10-08 |
| CVE-2024-8626 | Rockwell Automation CompactLogix 安全漏洞 — CompactLogix 5380 controllers | 7.5AI | High AI | 2024-10-08 |
| CVE-2024-43789 | Discourse 资源管理错误漏洞 — discourse | 7.5 | High | 2024-10-07 |
| CVE-2024-47554 | Apache Commons IO 资源管理错误漏洞 — Apache Commons IO | 7.5 | - | 2024-10-03 |
| CVE-2024-20502 | Cisco AnyConnect VPN 安全漏洞 — Cisco Meraki MX Firmware | 5.8 | Medium | 2024-10-02 |
| CVE-2024-20500 | Cisco AnyConnect VPN 安全漏洞 — Cisco Meraki MX Firmware | 5.8 | Medium | 2024-10-02 |
| CVE-2024-9358 | ThingsBoard 资源管理错误漏洞 — ThingsBoard | 5.3 | Medium | 2024-10-01 |
| CVE-2024-8451 | PLANET switch devices 安全漏洞 — GS-4210-24PL4C hardware 2.0 | 7.5 | High | 2024-09-30 |
| CVE-2024-37125 | Dell SmartFabric OS10 资源管理错误漏洞 — SmartFabric OS10 Software | 7.5 | High | 2024-09-26 |
| CVE-2024-47003 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2024-09-26 |
| CVE-2024-7254 | Protocol Buffers 安全漏洞 — Protocol Buffers | 9.1AI | Critical AI | 2024-09-19 |
| CVE-2024-8892 | CIRCUTOR TCP2RS+ 安全漏洞 — CIRCUTOR TCP2RS+ | 5.3 | Medium | 2024-09-18 |
| CVE-2024-8939 | vLLM 资源管理错误漏洞 | 6.2 | Medium | 2024-09-17 |
| CVE-2024-38236 | DHCP 安全漏洞 — Windows Server 2008 Service Pack 2 | 7.5 | High | 2024-09-10 |
| CVE-2024-43647 | Siemens SIMATIC 安全漏洞 — SIMATIC S7-200 SMART CPU CR40 | 7.5 | High | 2024-09-10 |
| CVE-2024-8418 | Aardvark-dns 资源管理错误漏洞 | 7.5 | High | 2024-09-04 |
| CVE-2024-21658 | Discourse Calendar 资源管理错误漏洞 — discourse-calendar | 4.3 | Medium | 2024-08-30 |
| CVE-2024-43806 | rustix 安全漏洞 — rustix | 6.5 | Medium | 2024-08-26 |
| CVE-2024-43105 | Mattermost plugin Channel Export 安全漏洞 — Mattermost | 4.3 | Medium | 2024-08-23 |
| CVE-2024-8041 | GitLab Enterprise Edition和GitLab Community Edition 安全漏洞 — GitLab | 6.5 | Medium | 2024-08-22 |
| CVE-2024-39810 | Mattermost 安全漏洞 — Mattermost | 4.9 | Medium | 2024-08-22 |
| CVE-2024-7592 | Python 安全漏洞 — CPython | 5.3 | - | 2024-08-19 |
| CVE-2024-43380 | fugit 安全漏洞 — fugit | 5.3 | Medium | 2024-08-19 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1801 条 CVE 漏洞。