CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1799 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2023-22470 | Nextcloud 输入验证错误漏洞 — security-advisories | 3.5 | Low | 2023-01-14 |
| CVE-2023-22396 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | High | 2023-01-12 |
| CVE-2023-22400 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS Evolved | 7.5 | High | 2023-01-12 |
| CVE-2022-34335 | IBM Sterling Partner Engagement Manager 资源管理错误漏洞 — Sterling Partner Engagement Manager | 6.5 | Medium | 2023-01-11 |
| CVE-2023-21728 | Microsoft Windows Netlogon 安全漏洞 — Windows 10 Version 1809 | 7.5 | High | 2023-01-10 |
| CVE-2023-21543 | Microsoft Windows 安全漏洞 — Windows 10 Version 1809 | 8.1 | High | 2023-01-10 |
| CVE-2021-32821 | mootools 资源管理错误漏洞 — mootools-core | 6.2 | Medium | 2023-01-03 |
| CVE-2022-4767 | memos 资源管理错误漏洞 — usememos/memos | 7.5 | - | 2022-12-27 |
| CVE-2020-26302 | is.js 资源管理错误漏洞 — is.js | 7.5 | High | 2022-12-23 |
| CVE-2022-39164 | IBM AIX 安全漏洞 — AIX | 6.2 | Medium | 2022-12-23 |
| CVE-2022-39165 | IBM AIX 安全漏洞 — AIX | 6.2 | Medium | 2022-12-23 |
| CVE-2020-36620 | EnumStringValues 资源管理错误漏洞 — EnumStringValues | 3.5 | Low | 2022-12-21 |
| CVE-2022-23524 | Helm 资源管理错误漏洞 — helm | 5.3 | Medium | 2022-12-15 |
| CVE-2022-45044 | Siemens SIPROTEC 5 资源管理错误漏洞 — SIPROTEC 5 6MD84 (CP300) | 5.3 | Medium | 2022-12-13 |
| CVE-2022-46351 | Siemens SCALANCE Series 资源管理错误漏洞 — SCALANCE X204RNA (HSR) | 7.5 | - | 2022-12-13 |
| CVE-2022-46352 | Siemens SCALANCE Series 资源管理错误漏洞 — SCALANCE X204RNA (HSR) | 7.5 | - | 2022-12-13 |
| CVE-2022-23492 | go-libp2p 资源管理错误漏洞 — go-libp2p | 7.5 | High | 2022-12-08 |
| CVE-2022-23471 | containerd 资源管理错误漏洞 — containerd | 5.7 | Medium | 2022-12-07 |
| CVE-2022-23487 | ChainSafe js-libp2p-noise 资源管理错误漏洞 — js-libp2p | 7.5 | High | 2022-12-07 |
| CVE-2022-23486 | rust-libp2p 资源管理错误漏洞 — rust-libp2p | 7.5 | High | 2022-12-07 |
| CVE-2022-20691 | Cisco ATA 190 资源管理错误漏洞 — Cisco Analog Telephone Adaptor (ATA) Software | 5.3 | Medium | 2022-12-07 |
| CVE-2022-30122 | RubyGem Rack 资源管理错误漏洞 — https://github.com/rack/rack | 7.5 | - | 2022-12-05 |
| CVE-2022-41969 | Nextcloud 资源管理错误漏洞 — security-advisories | 2.4 | Low | 2022-12-01 |
| CVE-2022-41968 | Nextcloud 资源管理错误漏洞 — security-advisories | 3.5 | Low | 2022-12-01 |
| CVE-2022-39346 | Nextcloud 资源管理错误漏洞 — security-advisories | 3.5 | Low | 2022-11-25 |
| CVE-2022-41932 | XWiki Platform 资源管理错误漏洞 — xwiki-platform | 7.5 | High | 2022-11-23 |
| CVE-2022-41952 | synapse 资源管理错误漏洞 — synapse | 6.5 | Medium | 2022-11-22 |
| CVE-2022-4006 | WBCE CMS 安全漏洞 — CMS | 3.7 | Low | 2022-11-15 |
| CVE-2022-20854 | Cisco Firepower Management Center和Firepower Threat Defense 资源管理错误漏洞 — Cisco Firepower Management Center | 7.5 | High | 2022-11-10 |
| CVE-2022-43572 | Splunk 代码注入漏洞 — Splunk Enterprise | 7.5 | High | 2022-11-04 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1799 条 CVE 漏洞。