CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1799 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-5522 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2023-10-17 |
| CVE-2022-43893 | IBM Security Verify Privilege Manager 资源管理错误漏洞 — Security Verify Privilege | 2.7 | Low | 2023-10-17 |
| CVE-2023-44388 | Discourse 资源管理错误漏洞 — discourse | 7.5 | High | 2023-10-16 |
| CVE-2023-45150 | Nextcloud 资源管理错误漏洞 — security-advisories | 4.3 | Medium | 2023-10-16 |
| CVE-2023-40180 | Silverstripe CMS GraphQL Server 资源管理错误漏洞 — silverstripe-graphql | 7.5 | High | 2023-10-16 |
| CVE-2023-5595 | GPAC 资源管理错误漏洞 — gpac/gpac | 5.5 | - | 2023-10-16 |
| CVE-2022-43740 | IBM Security Verify Access 资源管理错误漏洞 — Security Verify Access | 7.5 | High | 2023-10-14 |
| CVE-2023-38251 | Adobe Commerce 资源管理错误漏洞 — Adobe Commerce | 5.3 | Medium | 2023-10-13 |
| CVE-2023-36841 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | High | 2023-10-12 |
| CVE-2023-27314 | NetApp ONTAP 安全漏洞 — ONTAP 9 | 7.5 | High | 2023-10-12 |
| CVE-2023-25774 | SoftEther VPN 资源管理错误漏洞 — SoftEther VPN | 7.5 | High | 2023-10-12 |
| CVE-2023-36431 | Microsoft Message Queuing 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2023-10-10 |
| CVE-2023-36435 | Microsoft QUIC 安全漏洞 — PowerShell 7.3 | 7.5 | High | 2023-10-10 |
| CVE-2023-36579 | Microsoft Message Queuing 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2023-10-10 |
| CVE-2023-36606 | Microsoft Message Queuing 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2023-10-10 |
| CVE-2023-36703 | Microsoft Windows DHCP Server 安全漏洞 — Windows Server 2019 | 7.5 | High | 2023-10-10 |
| CVE-2023-43786 | X.Org libX11 安全漏洞 | 5.5 | Medium | 2023-10-10 |
| CVE-2023-37195 | Siemens SIMATIC 多款产品资源管理错误漏洞 — SIMATIC CP 1604 | 4.4 | Medium | 2023-10-10 |
| CVE-2023-5333 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2023-10-09 |
| CVE-2023-5330 | Mattermost 安全漏洞 — Mattermost | 4.3 | Medium | 2023-10-09 |
| CVE-2023-43810 | OpenTelemetry-Go Contrib 资源管理错误漏洞 — opentelemetry-python-contrib | 7.5 | High | 2023-10-06 |
| CVE-2023-20259 | Cisco 多款产品安全漏洞 — Cisco Emergency Responder | 8.6 | High | 2023-10-04 |
| CVE-2023-3153 | Open Virtual Network 安全漏洞 — ovn | 5.3 | Medium | 2023-10-04 |
| CVE-2023-26151 | asyncua 安全漏洞 — asyncua | 5.3 | Medium | 2023-10-03 |
| CVE-2023-5196 | Mattermost 资源管理错误漏洞 — Mattermost | 6.5 | Medium | 2023-09-29 |
| CVE-2023-20176 | Cisco Access Point 资源管理错误漏洞 — Cisco Aironet Access Point Software | 5.8 | Medium | 2023-09-27 |
| CVE-2023-20268 | Cisco access point 资源管理错误漏洞 — Cisco Aironet Access Point Software | 4.7 | Medium | 2023-09-27 |
| CVE-2023-43646 | get-func-name 安全漏洞 — get-func-name | 8.6 | High | 2023-09-26 |
| CVE-2023-43775 | Eaton SMP SG-4260 安全漏洞 — SMP SG-4260 | 4.7 | Medium | 2023-09-26 |
| CVE-2023-5157 | MariaDB 资源管理错误漏洞 — Red Hat Enterprise Linux 8 | 7.5 | High | 2023-09-26 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1799 条 CVE 漏洞。