CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1799 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-45028 | QNAP 多款产品安全漏洞 — QTS | 5.5 | Medium | 2024-02-02 |
| CVE-2024-23824 | mailcow 资源管理错误漏洞 — mailcow-dockerized | 4.7 | Medium | 2024-02-02 |
| CVE-2024-24752 | Bref 资源管理错误漏洞 — bref | 6.5 | Medium | 2024-02-01 |
| CVE-2024-1014 | SE-elektronic GmbH E-DDC 资源管理错误漏洞 — E-DDC3.3 | 6.2 | Medium | 2024-01-29 |
| CVE-2023-6450 | Lenovo App Store 资源管理错误漏洞 — Lenovo App Store Application | 5.5 | Medium | 2024-01-19 |
| CVE-2024-0581 | Sandsprite scdbg 安全漏洞 — Scdbg | 4.0 | Medium | 2024-01-16 |
| CVE-2023-52098 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 7.5AI | High AI | 2024-01-16 |
| CVE-2024-21655 | Discourse 资源管理错误漏洞 — discourse | 4.3 | Medium | 2024-01-12 |
| CVE-2023-48297 | Discourse 安全漏洞 — discourse | 8.6 | High | 2024-01-12 |
| CVE-2023-49295 | quic-go 资源管理错误漏洞 — quic-go | 6.4 | Medium | 2024-01-10 |
| CVE-2024-0348 | Engineers Online Portal 资源管理错误漏洞 — Engineers Online Portal | 4.3 | Medium | 2024-01-09 |
| CVE-2024-20672 | Microsoft .NET Core 安全漏洞 — .NET 6.0 | 7.5 | High | 2024-01-09 |
| CVE-2024-22164 | Splunk 安全漏洞 — Splunk Enterprise Security (ES) | 4.3 | Medium | 2024-01-09 |
| CVE-2024-21651 | XWiki Platform 资源管理错误漏洞 — xwiki-platform | 7.5 | High | 2024-01-08 |
| CVE-2024-0241 | encoded_id-rails 安全漏洞 | 7.5AI | High AI | 2024-01-04 |
| CVE-2023-26157 | libredwg 安全漏洞 — libredwg | 5.5 | Medium | 2024-01-02 |
| CVE-2023-50730 | Grackle 安全漏洞 — grackle | 7.5 | High | 2023-12-22 |
| CVE-2023-46131 | Grails 资源管理错误漏洞 — grails-core | 6.5 | Medium | 2023-12-20 |
| CVE-2023-50249 | Sentry Astro SDK 资源管理错误漏洞 — sentry-javascript | 7.5 | High | 2023-12-20 |
| CVE-2023-50707 | EFACEC BCU 500 资源管理错误漏洞 — BCU 500 | 9.6 | Critical | 2023-12-19 |
| CVE-2023-46104 | Apache Superset 资源管理错误漏洞 — Apache Superset | 6.5 | Medium | 2023-12-19 |
| CVE-2023-6193 | quiche 安全漏洞 — quiche | 5.3 | Medium | 2023-12-12 |
| CVE-2023-49809 | Mattermost 资源管理错误漏洞 — Mattermost | 4.3 | Medium | 2023-12-12 |
| CVE-2023-45847 | Mattermost 资源管理错误漏洞 — Mattermost | 4.3 | Medium | 2023-12-12 |
| CVE-2023-5870 | PostgreSQL 安全漏洞 — Red Hat Advanced Cluster Security 4.2 | 2.2 | Low | 2023-12-10 |
| CVE-2023-4486 | Johnson Controls Facility Explorer 安全漏洞 — Metasys NAE55/SNE/SNC | 7.5 | High | 2023-12-07 |
| CVE-2023-35909 | WordPress Plugin Ninja Forms Contact Form 资源管理错误漏洞 — Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress | 5.3 | Medium | 2023-12-07 |
| CVE-2023-6180 | boring 安全漏洞 — tokio-boring | 5.3 | Medium | 2023-12-05 |
| CVE-2023-39248 | Dell OS10 Networking Switches 安全漏洞 — Dell Networking OS10 | 7.5 | High | 2023-12-05 |
| CVE-2023-49290 | lestrrat-go jwx 资源管理错误漏洞 — jwx | 5.3 | Medium | 2023-12-04 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1799 条 CVE 漏洞。