CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1800 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-20344 | Cisco UCS 6400 Series Fabric Interconnects 安全漏洞 — Cisco Unified Computing System (Managed) | 5.3 | Medium | 2024-02-28 |
| CVE-2024-20321 | Cisco NX-OS Software 安全漏洞 — Cisco NX-OS Software | 8.6 | High | 2024-02-28 |
| CVE-2024-27088 | es5-ext 安全漏洞 — es5-ext | - | - | 2024-02-26 |
| CVE-2024-22201 | Eclipse Jetty 安全漏洞 — jetty.project | 7.5 | High | 2024-02-26 |
| CVE-2024-23835 | Suricata 安全漏洞 — suricata | 7.5 | High | 2024-02-26 |
| CVE-2024-1635 | Red Hat Undertow 资源管理错误漏洞 | 7.5 | High | 2024-02-19 |
| CVE-2024-25978 | moodle 安全漏洞 | 7.5 | High | 2024-02-19 |
| CVE-2024-24750 | undici 资源管理错误漏洞 — undici | 6.5 | Medium | 2024-02-16 |
| CVE-2024-20716 | Adobe Commerce 资源管理错误漏洞 — Adobe Commerce | 4.9 | Medium | 2024-02-15 |
| CVE-2024-25617 | Squid 安全漏洞 — squid | 5.3 | Medium | 2024-02-14 |
| CVE-2024-23952 | Apache Superset 资源管理错误漏洞 — Apache Superset | 6.5 | Medium | 2024-02-14 |
| CVE-2024-24814 | mod_auth_openidc 安全漏洞 — mod_auth_openidc | 7.5 | High | 2024-02-13 |
| CVE-2024-21342 | Microsoft DNS Server 安全漏洞 — Windows 11 version 22H2 | 7.5 | High | 2024-02-13 |
| CVE-2024-21386 | Microsoft .NET 安全漏洞 — ASP.NET Core 6.0 | 7.5 | High | 2024-02-13 |
| CVE-2024-24781 | HIMA Paul Hildebrandt多个产品资源管理错误漏洞 — F30 03X YY (COM) | 7.5 | High | 2024-02-13 |
| CVE-2024-1309 | Honeywell Niagara Framework 资源管理错误漏洞 — Niagara Framework | 6.5 | Medium | 2024-02-13 |
| CVE-2024-25112 | Exiv2 安全漏洞 — exiv2 | 5.5 | Medium | 2024-02-12 |
| CVE-2023-6681 | JWCrypto 安全漏洞 — Red Hat Enterprise Linux 8 | 5.3 | Medium | 2024-02-12 |
| CVE-2023-41707 | Open-Xchange App Suite 安全漏洞 — OX App Suite | 6.5 | Medium | 2024-02-12 |
| CVE-2023-41706 | Open-Xchange App Suite 安全漏洞 — OX App Suite | 6.5 | Medium | 2024-02-12 |
| CVE-2023-41705 | Open-Xchange App Suite 安全漏洞 — OX App Suite | 6.5 | Medium | 2024-02-12 |
| CVE-2024-23323 | Envoy 资源管理错误漏洞 — envoy | 4.3 | Medium | 2024-02-09 |
| CVE-2024-1402 | Mattermost 资源管理错误漏洞 — Mattermost | 4.3 | Medium | 2024-02-09 |
| CVE-2024-0842 | WordPress Plugin Backuply 安全漏洞 — Backuply – Backup, Restore, Migrate and Clone | 7.5 | High | 2024-02-09 |
| CVE-2023-32341 | IBM Sterling B2B Integrator 资源管理错误漏洞 — Sterling B2B Integrator | 6.5 | Medium | 2024-02-09 |
| CVE-2024-22332 | IBM Integration Bus 资源管理错误漏洞 — Integration Bus for z/OS | 6.5 | Medium | 2024-02-09 |
| CVE-2024-24575 | libgit2 资源管理错误漏洞 — libgit2 | 7.5 | High | 2024-02-06 |
| CVE-2024-24943 | JetBrains Toolbox 安全漏洞 — Toolbox App | 5.3 | Medium | 2024-02-06 |
| CVE-2024-24762 | FastAPI 资源管理错误漏洞 — python-multipart | 7.5 | High | 2024-02-05 |
| CVE-2023-31006 | IBM Security Verify Access资源管理错误漏洞 — Security Verify Access Appliance | 6.5 | Medium | 2024-02-03 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1800 条 CVE 漏洞。