CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1800 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-0157 | Dell Storage Resource Manager 资源管理错误漏洞 — Dell Storage Resource Manager | 5.9 | Medium | 2024-04-12 |
| CVE-2024-3569 | AnythingLLM 资源管理错误漏洞 — mintplex-labs/anything-llm | 7.5AI | High AI | 2024-04-10 |
| CVE-2024-26215 | Microsoft Windows DHCP Server 安全漏洞 — Windows Server 2019 | 7.5 | High | 2024-04-09 |
| CVE-2024-26212 | Microsoft Windows DHCP Server 安全漏洞 — Windows Server 2019 | 7.5 | High | 2024-04-09 |
| CVE-2024-28949 | Mattermost Server 安全漏洞 — Mattermost | 4.3 | Medium | 2024-04-05 |
| CVE-2024-31209 | oidcc 安全漏洞 — oidcc | 5.3 | Medium | 2024-04-04 |
| CVE-2024-29893 | Argo CD 安全漏洞 — argo-cd | 6.5 | Medium | 2024-03-29 |
| CVE-2024-23450 | Elasticsearch 安全漏洞 — Elasticsearch | 4.9 | Medium | 2024-03-27 |
| CVE-2023-47150 | IBM Common Cryptographic Architecture 资源管理错误漏洞 — Common Cryptographic Architecture | 7.5 | High | 2024-03-26 |
| CVE-2023-5685 | Red Hat XNIO 安全漏洞 — Red Hat build of Apache Camel 4.4.0 for Spring Boot | 7.5 | High | 2024-03-22 |
| CVE-2024-29186 | Bref 安全漏洞 — bref | 5.3 | Medium | 2024-03-22 |
| CVE-2024-28863 | node-tar 安全漏洞 — node-tar | 6.5 | Medium | 2024-03-21 |
| CVE-2023-49837 | WordPress Plugin Code Embed 资源管理错误漏洞 — Code Embed | 6.5 | Medium | 2024-03-21 |
| CVE-2024-27085 | Discourse 安全漏洞 — discourse | 6.5 | Medium | 2024-03-15 |
| CVE-2024-27100 | Discourse 安全漏洞 — discourse | 6.5 | Medium | 2024-03-15 |
| CVE-2024-24827 | Discourse 安全漏洞 — discourse | 5.3 | Medium | 2024-03-15 |
| CVE-2024-28854 | tls-listener 安全漏洞 — tls-listener | 7.5 | High | 2024-03-15 |
| CVE-2024-2446 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-03-15 |
| CVE-2024-28053 | Mattermost 安全漏洞 — Mattermost | 3.1 | Low | 2024-03-15 |
| CVE-2024-24975 | Mattermost 安全漏洞 — Mattermost Mobile | 3.5 | Low | 2024-03-15 |
| CVE-2024-1410 | Cloudflare quiche 资源管理错误漏洞 — quiche | 3.7 | Low | 2024-03-12 |
| CVE-2024-1765 | Cloudflare quiche 安全漏洞 — quiche | 5.9 | Medium | 2024-03-12 |
| CVE-2024-26190 | Microsoft QUIC 安全漏洞 — Microsoft Visual Studio 2022 version 17.9 | 7.5 | High | 2024-03-12 |
| CVE-2024-21392 | Microsoft .NET和Microsoft Visual Studio 安全漏洞 — Microsoft Visual Studio 2022 version 17.9 | 7.5 | High | 2024-03-12 |
| CVE-2024-28122 | JWX 安全漏洞 — jwx | 6.8 | Medium | 2024-03-09 |
| CVE-2024-28176 | jose 安全漏洞 — jose | 4.9 | Medium | 2024-03-09 |
| CVE-2022-43880 | IBM QRadar WinCollect Agent 资源管理错误漏洞 — QRadar WinCollect Agent | 4.4 | Medium | 2024-03-03 |
| CVE-2024-1953 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-02-29 |
| CVE-2024-24988 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2024-02-29 |
| CVE-2024-26141 | Rack 资源管理错误漏洞 — rack | 5.8 | Medium | 2024-02-28 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1800 条 CVE 漏洞。