CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1800 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-6501 | NetworkManager 安全漏洞 | 3.1 | Low | 2024-07-09 |
| CVE-2024-38068 | Microsoft Windows Online Certificate Status Protocol 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2024-07-09 |
| CVE-2024-38067 | Microsoft Windows Online Certificate Status Protocol 安全漏洞 — Windows Server 2019 | 7.5 | High | 2024-07-09 |
| CVE-2024-38031 | Microsoft Windows Online Certificate Status Protocol 资源管理错误漏洞 — Windows Server 2019 | 7.5 | High | 2024-07-09 |
| CVE-2024-38027 | Microsoft Line Printer Daemon Service 安全漏洞 — Windows 10 Version 1809 | 6.5 | Medium | 2024-07-09 |
| CVE-2024-30105 | Microsoft .NET Core和Microsoft Visual Studio 安全漏洞 — .NET 8.0 | 7.5 | High | 2024-07-09 |
| CVE-2024-38015 | Microsoft Remote Desktop Client 安全漏洞 — Windows Server 2019 | 7.5 | High | 2024-07-09 |
| CVE-2024-35270 | Microsoft Windows 安全漏洞 — Windows 10 Version 1809 | 5.3 | Medium | 2024-07-09 |
| CVE-2023-39328 | OpenJPEG 资源管理错误漏洞 | 5.5 | Medium | 2024-07-09 |
| CVE-2024-39895 | Directus 安全漏洞 — directus | 6.5 | Medium | 2024-07-08 |
| CVE-2024-6434 | WordPress plugin Premium Addons for Elementor 安全漏洞 — Premium Addons for Elementor – Powerful Elementor Templates & Widgets | 3.1 | Low | 2024-07-04 |
| CVE-2024-6126 | Cockpit 资源管理错误漏洞 | 3.2 | Low | 2024-07-03 |
| CVE-2024-6427 | MESbook 资源管理错误漏洞 — MESbook | 7.5 | High | 2024-07-03 |
| CVE-2024-1816 | GitLab 资源管理错误漏洞 — GitLab | 5.3 | Medium | 2024-06-26 |
| CVE-2024-4557 | GitLab 资源管理错误漏洞 — GitLab | 6.5 | Medium | 2024-06-26 |
| CVE-2024-38520 | SoftEther VPN 安全漏洞 — SoftEtherVPN | 5.3 | Medium | 2024-06-26 |
| CVE-2024-5013 | Progress Software WhatsUp Gold 2023.1.3 安全漏洞 — WhatsUp Gold | 7.5 | High | 2024-06-25 |
| CVE-2024-5011 | Progress Software WhatsUp Gold 安全漏洞 — WhatsUp Gold | 7.5 | High | 2024-06-25 |
| CVE-2024-5216 | AnythingLLM 安全漏洞 — mintplex-labs/anything-llm | 9.1AI | Critical AI | 2024-06-25 |
| CVE-2023-45196 | AdminerEvo 安全漏洞 — Adminer | 7.5AI | High AI | 2024-06-24 |
| CVE-2024-23443 | Elastic Kibana 安全漏洞 — Kibana | 4.9 | Medium | 2024-06-19 |
| CVE-2024-37904 | Minder 安全漏洞 — minder | 5.7 | Medium | 2024-06-18 |
| CVE-2024-33001 | SAP NetWeaver 资源管理错误漏洞 — SAP NetWeaver and ABAP platform | 6.5 | Medium | 2024-06-11 |
| CVE-2024-34688 | SAP NetWeaver和SAP NetWeaver AS 资源管理错误漏洞 — SAP NetWeaver AS Java | 7.5 | High | 2024-06-11 |
| CVE-2024-3153 | AnythingLLM 资源管理错误漏洞 — mintplex-labs/anything-llm | 7.5AI | High AI | 2024-06-06 |
| CVE-2024-34364 | Envoy 安全漏洞 — envoy | 5.7 | Medium | 2024-06-04 |
| CVE-2024-5422 | 多款SEH产品 安全漏洞 — utnserver Pro | 7.5AI | High AI | 2024-06-04 |
| CVE-2024-35221 | RubyGems 安全漏洞 — rubygems.org | 4.3 | Medium | 2024-05-29 |
| CVE-2024-35194 | Minder 安全漏洞 — minder | 5.3 | Medium | 2024-05-20 |
| CVE-2024-4284 | AnythingLLM 安全漏洞 — mintplex-labs/anything-llm | 7.5 | - | 2024-05-19 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1800 条 CVE 漏洞。