CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1796 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-1378 | Cisco StarOS operating system 资源管理错误漏洞 — Cisco ASR 5000 Series Software | 5.3 | Medium | 2021-02-17 |
| CVE-2021-22553 | Jetty 资源管理错误漏洞 — Gerrit | 6.5 | Medium | 2021-02-17 |
| CVE-2021-21317 | Uap-core 资源管理错误漏洞 — uap-core | 5.3 | Medium | 2021-02-16 |
| CVE-2021-22880 | Postgresql PostgreSQL 资源管理错误漏洞 — https://github.com/rails/rails | 7.5 | - | 2021-02-11 |
| CVE-2020-35498 | Openvswitch 资源管理错误漏洞 — openvswitch | 7.5 | - | 2021-02-11 |
| CVE-2021-21296 | Fleet 安全漏洞 — fleet | 2.7 | Low | 2021-02-10 |
| CVE-2021-21306 | marked 资源管理错误漏洞 — marked | 5.3 | Medium | 2021-02-08 |
| CVE-2021-21240 | httplib2 资源管理错误漏洞 — httplib2 | 7.5 | High | 2021-02-08 |
| CVE-2021-1266 | Cisco Managed Services Accelerator 资源管理错误漏洞 — Cisco Managed Services Accelerator | 4.3 | Medium | 2021-02-04 |
| CVE-2021-21294 | Http4s Blaze 资源管理错误漏洞 — http4s | 7.5 | High | 2021-02-02 |
| CVE-2021-21293 | Http4s Blaze 资源管理错误漏洞 — blaze | 7.5 | High | 2021-02-02 |
| CVE-2021-21285 | Docker 代码问题漏洞 — moby | 6.5 | Medium | 2021-02-02 |
| CVE-2021-21254 | CKEditor 资源管理错误漏洞 — ckeditor5 | 6.5 | Medium | 2021-01-29 |
| CVE-2021-25909 | ZIV 4CCT firmware 资源管理错误漏洞 — 4CCT-EA6-334126BF | 8.6 | High | 2021-01-29 |
| CVE-2021-20185 | Moodle 资源管理错误漏洞 — moodle | 5.3 | - | 2021-01-28 |
| CVE-2021-21271 | Tendermint 资源管理错误漏洞 — tendermint | 6.5 | Medium | 2021-01-26 |
| CVE-2020-27295 | Honeywell OPC UA Tunneller 资源管理错误漏洞 — OPC UA Tunneller | 7.5 | - | 2021-01-26 |
| CVE-2020-8295 | Nextcloud 资源管理错误漏洞 — Nextcloud Server | 7.5 | - | 2021-01-26 |
| CVE-2020-8293 | Nextcloud 资源管理错误漏洞 — Nextcloud Server | 6.5 | - | 2021-01-26 |
| CVE-2021-1312 | Cisco Elastic Services Controller 资源管理错误漏洞 — Cisco Elastic Services Controller | 5.3 | Medium | 2021-01-20 |
| CVE-2021-0215 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 6.5 | Medium | 2021-01-15 |
| CVE-2021-0202 | Juniper Networks MX Series and EX9200 Series 资源管理错误漏洞 — Junos OS | 7.5 | High | 2021-01-15 |
| CVE-2021-21252 | jQuery 资源管理错误漏洞 — jquery-validation | 5.3 | Medium | 2021-01-13 |
| CVE-2021-21236 | Kozea CairoSVG 资源管理错误漏洞 — CairoSVG | 5.7 | Medium | 2021-01-06 |
| CVE-2021-21235 | Kamadak Exif-rs 资源管理错误漏洞 — exif-rs | 5.7 | Medium | 2021-01-06 |
| CVE-2020-29490 | DELL Dell EMC Unity和UnityVSA 资源管理错误漏洞 — Unity | 7.5 | High | 2021-01-05 |
| CVE-2020-26289 | Date And Time 资源管理错误漏洞 — date-and-time | 7.5 | High | 2020-12-28 |
| CVE-2020-26264 | Ethereum Go-ethereum 资源管理错误漏洞 — go-ethereum | 6.5 | Medium | 2020-12-11 |
| CVE-2020-12516 | WAGO 750-88x和750-352 资源管理错误漏洞 — 750-331/xxx-xxx | 7.5 | High | 2020-12-10 |
| CVE-2020-26257 | Matrix Synapse 资源管理错误漏洞 — synapse | 6.5 | Medium | 2020-12-09 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1796 条 CVE 漏洞。