CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1799 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-28440 | Discourse 资源管理错误漏洞 — discourse | 2.7 | Low | 2023-04-18 |
| CVE-2023-26048 | Eclipse Jetty 资源管理错误漏洞 — jetty.project | 5.3 | Medium | 2023-04-18 |
| CVE-2023-30769 | utxo-workshop 安全漏洞 — Node | 9.1 | Critical | 2023-04-17 |
| CVE-2023-29013 | Containous Traefik 资源管理错误漏洞 — traefik | 7.5 | High | 2023-04-14 |
| CVE-2023-20863 | Spring Framework 安全漏洞 — Spring Framework | 6.5 | - | 2023-04-13 |
| CVE-2023-24545 | Arista Networks CloudEOS 资源管理错误漏洞 — EOS | 7.5 | High | 2023-04-12 |
| CVE-2023-28217 | Microsoft Windows Network Address Translation (NAT) 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2023-04-11 |
| CVE-2023-29185 | SAP NetWeaver AS 资源管理错误漏洞 — NetWeaver AS for ABAP (Business Server Pages) | 5.3 | Medium | 2023-04-11 |
| CVE-2023-28763 | SAP NetWeaver AS 资源管理错误漏洞 — NetWeaver AS for ABAP and ABAP Platform | 6.5 | Medium | 2023-04-11 |
| CVE-2023-20051 | Cisco Packet Data Network Gateway 安全漏洞 — Cisco ASR 5000 Series Software | 5.8 | Medium | 2023-04-05 |
| CVE-2023-28837 | Wagtail 跨站脚本漏洞 — wagtail | 4.9 | Medium | 2023-04-03 |
| CVE-2023-24824 | cmark-gfm 资源管理错误漏洞 — cmark-gfm | 5.3 | Medium | 2023-03-31 |
| CVE-2023-26485 | cmark-gfm 资源管理错误漏洞 — cmark-gfm | 5.3 | Medium | 2023-03-31 |
| CVE-2022-4899 | Zstandard 资源管理错误漏洞 — zstd | 6.2 | - | 2023-03-31 |
| CVE-2023-28846 | Unpoly 资源管理错误漏洞 — unpoly-rails | 5.9 | Medium | 2023-03-30 |
| CVE-2023-28644 | Nextcloud 资源管理错误漏洞 — security-advisories | 5.7 | Medium | 2023-03-30 |
| CVE-2023-28507 | Rocket Software UniData 和 UniVerse 资源管理错误漏洞 — UniData | 9.1 | - | 2023-03-29 |
| CVE-2023-28626 | Comrak 资源管理错误漏洞 — comrak | 5.3 | Medium | 2023-03-28 |
| CVE-2023-1654 | GPAC 资源管理错误漏洞 — gpac/gpac | 5.5 | - | 2023-03-27 |
| CVE-2023-0056 | Haproxy 资源管理错误漏洞 — haproxy | 6.5 | - | 2023-03-23 |
| CVE-2023-1605 | radare2 资源管理错误漏洞 — radareorg/radare2 | 6.2 | - | 2023-03-23 |
| CVE-2023-23396 | Microsoft Excel 资源管理错误漏洞 — Microsoft Office Online Server | 6.5 | Medium | 2023-03-14 |
| CVE-2023-27270 | SAP NetWeaver Application Server 资源管理错误漏洞 — NetWeaver Application Server for ABAP and ABAP Platform | 6.5 | Medium | 2023-03-14 |
| CVE-2023-25618 | SAP NetWeaver Application Server 资源管理错误漏洞 — NetWeaver AS for ABAP and ABAP Platform | 6.5 | Medium | 2023-03-14 |
| CVE-2023-27530 | rubygem-rack 安全漏洞 — https://github.com/rack/rack | 7.5 | - | 2023-03-10 |
| CVE-2023-27484 | crossplane 资源管理错误漏洞 — crossplane | 6.2 | Medium | 2023-03-09 |
| CVE-2023-27483 | crossplane 资源管理错误漏洞 — crossplane-runtime | 5.9 | Medium | 2023-03-09 |
| CVE-2022-41333 | Fortinet FortiRecorder 资源管理错误漏洞 — FortiRecorder | 6.8 | High | 2023-03-07 |
| CVE-2021-36395 | Moodle 安全漏洞 — Moodle | 7.5 | - | 2023-03-06 |
| CVE-2022-3277 | OpenStack 资源管理错误漏洞 — openstack-neutron | 6.5 | - | 2023-03-06 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1799 条 CVE 漏洞。