CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1797 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-31340 | Siemens SIMATIC 多款产品资源管理错误漏洞 — SIMATIC RF166C | 8.8 | - | 2021-06-08 |
| CVE-2021-26945 | Industrial Light and Magic OpenEXR 输入验证错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2021-22116 | RabbitMQ输入验证错误漏洞 — RabbitMQ | 7.5 | - | 2021-06-08 |
| CVE-2021-23215 | Industrial Light and Magic OpenEXR 资源管理错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2021-26260 | Industrial Light and Magic OpenEXR 资源管理错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2020-1750 | Red Hat OpenShift Container Platform 资源管理错误漏洞 — machine-config-operator-container | 6.5 | - | 2021-06-07 |
| CVE-2021-1564 | Cisco Video Surveillance Manager 资源管理错误漏洞 — Cisco Video Surveillance 7000 Series IP Cameras | 6.5 | Medium | 2021-06-04 |
| CVE-2021-1563 | Cisco Video Surveillance Manager 资源管理错误漏洞 — Cisco Video Surveillance 7000 Series IP Cameras | 6.5 | Medium | 2021-06-04 |
| CVE-2020-35510 | David M. Lloyd jboss-remoting 资源管理错误漏洞 — jboss-remoting | 5.9 | - | 2021-06-02 |
| CVE-2020-14340 | Red Hat XNIO 安全漏洞 — XNIO | 6.5 | - | 2021-06-02 |
| CVE-2020-14326 | Red Hat Resteasy 安全漏洞 — RESTEasy | 7.5 | - | 2021-06-02 |
| CVE-2021-32657 | Nextcloud 资源管理错误漏洞 — security-advisories | 4.3 | Medium | 2021-06-01 |
| CVE-2021-20237 | ZeroMQ 资源管理错误漏洞 — zeromq | 7.5 | - | 2021-05-28 |
| CVE-2021-20201 | spice 安全漏洞 — spice | 7.5 | - | 2021-05-28 |
| CVE-2020-1702 | containers image 资源管理错误漏洞 — containers/image | 5.5 | - | 2021-05-27 |
| CVE-2018-10868 | Red Hat Certification 访问控制错误漏洞 — redhat-certification | 7.5 | - | 2021-05-26 |
| CVE-2020-25673 | Linux kernel 资源管理错误漏洞 — Linux Kernel | 5.5 | - | 2021-05-26 |
| CVE-2021-32640 | github ws 资源管理错误漏洞 — ws | 5.3 | Medium | 2021-05-25 |
| CVE-2021-32455 | Sitel CAP/PRX 资源管理错误漏洞 — CAP/PRX | 6.8 | Medium | 2021-05-17 |
| CVE-2021-32617 | Exiv2 资源管理错误漏洞 — exiv2 | 4.7 | Medium | 2021-05-17 |
| CVE-2021-32816 | AngularJS ProtonMail Web Client 资源管理错误漏洞 — WebClient | 6.5 | Medium | 2021-05-14 |
| CVE-2021-29506 | graphhopper 资源管理错误漏洞 — graphhopper | 6.5 | Medium | 2021-05-13 |
| CVE-2021-22139 | Elastic Stack Kibana 资源管理错误漏洞 — Kibana | 6.5 | - | 2021-05-13 |
| CVE-2021-27385 | Siemens SmartVNC 资源管理错误漏洞 — SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) | 7.5 | - | 2021-05-12 |
| CVE-2020-25242 | 多款 Siemens 设备资源管理错误漏洞 — SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) | 7.5 | - | 2021-05-12 |
| CVE-2021-29509 | Puma 资源管理错误漏洞 — puma | 7.5 | High | 2021-05-11 |
| CVE-2021-29471 | synapse 安全特征问题漏洞 — synapse | 3.7 | Low | 2021-05-11 |
| CVE-2021-21419 | Eventlet 资源管理错误漏洞 — eventlet | 5.3 | Medium | 2021-05-07 |
| CVE-2021-31409 | vaadin-server 资源管理错误漏洞 — Vaadin | 7.5 | High | 2021-05-05 |
| CVE-2021-1489 | Cisco Firepower Device Manager 资源管理错误漏洞 — Cisco Firepower Threat Defense Software | 6.5 | - | 2021-04-29 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1797 条 CVE 漏洞。