CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1797 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2022-24713 | Github regex 资源管理错误漏洞 — regex | 7.5 | High | 2022-03-08 |
| CVE-2021-3733 | Python 资源管理错误漏洞 — python | 6.5 | - | 2022-03-07 |
| CVE-2022-25326 | Google Fscrypt 资源管理错误漏洞 — fscrypt | 5.5 | Medium | 2022-02-25 |
| CVE-2021-4021 | radare2 资源管理错误漏洞 — radare2 | 6.2 | - | 2022-02-24 |
| CVE-2022-0695 | radare2 资源管理错误漏洞 — radareorg/radare2 | 6.2 | - | 2022-02-24 |
| CVE-2022-20624 | Cisco NX-OS Software 输入验证错误漏洞 — Cisco NX-OS Software | 8.6 | High | 2022-02-23 |
| CVE-2022-0476 | radare2 资源管理错误漏洞 — radareorg/radare2 | 6.2 | - | 2022-02-23 |
| CVE-2021-4115 | polkit 安全漏洞 — polkitd | 5.5 | - | 2022-02-21 |
| CVE-2022-21698 | prometheus client golang 资源管理错误漏洞 — client_golang | 7.5 | High | 2022-02-15 |
| CVE-2022-22543 | SAP NetWeaver Application Server 资源管理错误漏洞 — SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) | 7.5 | - | 2022-02-09 |
| CVE-2022-23580 | Google TensorFlow 资源管理错误漏洞 — tensorflow | 6.5 | Medium | 2022-02-04 |
| CVE-2022-23591 | Google TensorFlow 资源管理错误漏洞 — tensorflow | 7.5 | High | 2022-02-04 |
| CVE-2022-22724 | Schneider Electric Modicon M340 资源管理错误漏洞 — Modicon M340 CPUs: BMXP34 (All Versions) | 7.5 | - | 2022-02-04 |
| CVE-2021-43859 | XStream 资源管理错误漏洞 — xstream | 7.5 | High | 2022-02-01 |
| CVE-2021-40406 | Reolink Rlc-410W 资源管理错误漏洞 — n/a | 7.5 | - | 2022-01-28 |
| CVE-2022-23030 | F5 BIG-IP 资源管理错误漏洞 — BIG-IP | 5.3 | - | 2022-01-25 |
| CVE-2022-23023 | F5 BIG-IP 资源管理错误漏洞 — BIG-IP & BIG-IQ | 6.5 | - | 2022-01-25 |
| CVE-2022-23024 | F5 BIG-IP AFM 资源管理错误漏洞 — BIG-IP AFM | 7.5 | - | 2022-01-25 |
| CVE-2022-23015 | F5 BIG-IP 资源管理错误漏洞 — BIG-IP | 7.5 | - | 2022-01-25 |
| CVE-2022-21708 | graphql-go 资源管理错误漏洞 — graphql-go | 6.5 | Medium | 2022-01-21 |
| CVE-2021-23236 | Fresenius Kabi Agilia Connect Infusion System 资源管理错误漏洞 — Agilia Link+ | 7.5 | High | 2022-01-21 |
| CVE-2022-22161 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | High | 2022-01-19 |
| CVE-2022-22155 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 6.5 | Medium | 2022-01-19 |
| CVE-2022-21700 | Object Computing micronaut 资源管理错误漏洞 — micronaut-core | 5.3 | Medium | 2022-01-18 |
| CVE-2022-21689 | OnionShare 安全漏洞 — onionshare | 7.5 | High | 2022-01-18 |
| CVE-2021-37865 | Mattermost 资源管理错误漏洞 — Mattermost | 4.3 | Medium | 2022-01-18 |
| CVE-2022-21680 | marked 安全漏洞 — marked | 7.5 | High | 2022-01-14 |
| CVE-2022-21681 | marked 安全漏洞 — marked | 7.5 | High | 2022-01-14 |
| CVE-2022-21670 | Markdown-It 资源管理错误漏洞 — markdown-it | 5.3 | Medium | 2022-01-10 |
| CVE-2020-9059 | Silicon Labs Z-Wave Chipsets 资源管理错误漏洞 — BE468 | 6.5 | - | 2022-01-07 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1797 条 CVE 漏洞。