CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 1796 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2019-1873 | Cisco Adaptive Security Appliances Software和Cisco Firepower Threat Defense 资源管理错误漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 7.5 | - | 2019-07-10 |
| CVE-2019-10977 | Mitsubishi Electric QJ71E71-100 资源管理错误漏洞 — MELSEC-Q series Ethernet module | 7.5 | - | 2019-05-23 |
| CVE-2019-1814 | Cisco Small Business 300 Series 资源管理错误漏洞 — Cisco Small Business 300 Series Managed Switches | 8.6 | - | 2019-05-15 |
| CVE-2019-6578 | 多款Siemens产品资源管理错误漏洞 — SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- | 7.5 | - | 2019-05-14 |
| CVE-2019-1703 | Cisco Firepower 2100 Series Firepower Threat Defense 资源管理错误漏洞 — Cisco Firepower Threat Defense Software | 8.6 | - | 2019-05-03 |
| CVE-2019-1704 | Cisco Firepower Threat Defense 资源管理错误漏洞 — Cisco Firepower Threat Defense Software | 7.4 | - | 2019-05-03 |
| CVE-2019-1696 | Cisco Firepower Threat Defense 资源管理错误漏洞 — Cisco Firepower Threat Defense Software | 7.4 | - | 2019-05-03 |
| CVE-2018-15388 | Cisco Adaptive Security Appliance Software和Firepower Threat Defense Software 资源管理错误漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 7.5 | - | 2019-05-03 |
| CVE-2019-10952 | Rockwell Automation CompactLogix 5370 资源管理错误漏洞 — CompactLogix 5370 L1 controllers | 9.8 | - | 2019-05-01 |
| CVE-2019-10948 | 多款Fujifilm产品资源管理错误漏洞 — Fujifilm FCR Capsula X/ Carbon X | 7.5 | - | 2019-04-30 |
| CVE-2018-16878 | Pacemaker 资源管理错误漏洞 — pacemaker | 5.5 | - | 2019-04-18 |
| CVE-2019-10953 | 多款PLC产品资源管理错误漏洞 — 1SAP120600R0071 PM554-TP-ETH | 7.5 | - | 2019-04-17 |
| CVE-2019-0031 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 6.5 | - | 2019-04-10 |
| CVE-2019-0033 | Juniper Networks Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | - | 2019-04-10 |
| CVE-2019-0038 | Juniper Networks SRX340和Juniper Networks SRX345 Junos OS 资源管理错误漏洞 — Junos OS | 7.5 | - | 2019-04-10 |
| CVE-2018-13296 | Synology MailPlus Server 资源管理错误漏洞 — MailPlus Server | 7.5 | - | 2019-04-01 |
| CVE-2019-5739 | Joyent Node.js 资源管理错误漏洞 — Node.js | 7.5 | - | 2019-03-28 |
| CVE-2019-5737 | Joyent Node.js 资源管理错误漏洞 — Node.js | 5.9 | - | 2019-03-28 |
| CVE-2019-1737 | Cisco IOS和IOS XE 资源管理错误漏洞 — Cisco IOS and IOS-XE Software | 8.6 | - | 2019-03-27 |
| CVE-2018-12545 | Eclipse Jetty 输入验证错误漏洞 — Eclipse Jetty | 7.5 | - | 2019-03-27 |
| CVE-2019-5419 | Rails 资源管理错误漏洞 — https://github.com/rails/rails | 7.5 | - | 2019-03-27 |
| CVE-2019-3874 | Linux kernel 资源管理错误漏洞 — kernel | 7.5 | - | 2019-03-25 |
| CVE-2019-6559 | 多款Moxa产品资源管理错误漏洞 — Moxa IKS, EDS | 6.5 | - | 2019-03-05 |
| CVE-2017-0938 | Ubiquiti Networks airMAX和EdgeMAX 输入验证错误漏洞 — airMAX, EdgeMAX | 7.5 | - | 2019-02-12 |
| CVE-2019-1672 | Cisco Web Security Appliance 资源管理错误漏洞 — Cisco Web Security Appliance (WSA) | 5.3 | - | 2019-02-08 |
| CVE-2019-6535 | 多款Misubishi产品资源管理错误漏洞 — Q03/04/06/13/26UDVCPU | 7.5 | High | 2019-02-05 |
| CVE-2018-16486 | defaults-deep 注入漏洞 — defaults-deep | 9.8 | - | 2019-02-01 |
| CVE-2018-16487 | lodash 资源管理错误漏洞 — lodash | 6.5 | - | 2019-02-01 |
| CVE-2018-16489 | just-extend 注入漏洞 — just-extend | 9.8 | - | 2019-02-01 |
| CVE-2018-16490 | mpath module 注入漏洞 — mpath | 9.4 | - | 2019-02-01 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 1796 条 CVE 漏洞。