CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 2083 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-21565 | Dell Technologies Dell PowerScale OneFS 资源管理错误漏洞 — PowerScale OneFS | 5.3 | Medium | 2021-08-02 |
| CVE-2021-25701 | PCoIP Software Client 资源管理错误漏洞 — - PCoIP Software Client | 5.5 | - | 2021-07-21 |
| CVE-2021-32763 | OpenProject安全漏洞 — openproject | 4.3 | Medium | 2021-07-20 |
| CVE-2021-0292 | Juniper Networks Junos OS Evolved 资源管理错误漏洞 — Junos OS Evolved | 6.5 | Medium | 2021-07-15 |
| CVE-2021-32740 | Addressable资源管理错误漏洞 — addressable | 7.5 | High | 2021-07-06 |
| CVE-2021-22119 | VMware Spring Security 安全漏洞 — Spring Security | 7.5 | - | 2021-06-29 |
| CVE-2021-32722 | MediaWiki GlobalNewFiles 资源管理错误漏洞 — GlobalNewFiles | 6.5 | Medium | 2021-06-28 |
| CVE-2021-32723 | Prism 资源管理错误漏洞 — prism | 7.4 | High | 2021-06-28 |
| CVE-2021-32823 | BinData 安全漏洞 — bindata | 3.7 | Low | 2021-06-23 |
| CVE-2021-32699 | Pterodactyl 资源管理错误漏洞 — wings | 6.5 | Medium | 2021-06-22 |
| CVE-2020-8299 | Citrix Systems NetScaler Gateway 资源管理错误漏洞 — Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP Edition | 7.5 | - | 2021-06-16 |
| CVE-2021-30468 | Apache CXF 资源管理错误漏洞 — Apache CXF | 7.5 | - | 2021-06-16 |
| CVE-2021-22906 | Nextcloud 资源管理错误漏洞 — Nextcloud End-to-End Encryption | 6.5 | - | 2021-06-11 |
| CVE-2021-22902 | Ruby 资源管理错误漏洞 — https://github.com/rails/rails | 7.5 | - | 2021-06-11 |
| CVE-2021-22904 | Ruby 安全漏洞 — https://github.com/rails/rails | 7.5 | - | 2021-06-11 |
| CVE-2021-23852 | Bosch IP cameras 资源管理错误漏洞 — CPP Firmware | 4.9 | Medium | 2021-06-09 |
| CVE-2021-31340 | Siemens SIMATIC 多款产品资源管理错误漏洞 — SIMATIC RF166C | 8.8 | - | 2021-06-08 |
| CVE-2021-26945 | Industrial Light and Magic OpenEXR 输入验证错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2021-22116 | RabbitMQ输入验证错误漏洞 — RabbitMQ | 7.5 | - | 2021-06-08 |
| CVE-2021-23215 | Industrial Light and Magic OpenEXR 资源管理错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2021-26260 | Industrial Light and Magic OpenEXR 资源管理错误漏洞 — OpenEXR | 5.5 | - | 2021-06-08 |
| CVE-2020-1750 | Red Hat OpenShift Container Platform 资源管理错误漏洞 — machine-config-operator-container | 6.5 | - | 2021-06-07 |
| CVE-2021-1564 | Cisco Video Surveillance Manager 资源管理错误漏洞 — Cisco Video Surveillance 7000 Series IP Cameras | 6.5 | Medium | 2021-06-04 |
| CVE-2021-1563 | Cisco Video Surveillance Manager 资源管理错误漏洞 — Cisco Video Surveillance 7000 Series IP Cameras | 6.5 | Medium | 2021-06-04 |
| CVE-2020-35510 | David M. Lloyd jboss-remoting 资源管理错误漏洞 — jboss-remoting | 5.9 | - | 2021-06-02 |
| CVE-2020-14340 | Red Hat XNIO 安全漏洞 — XNIO | 6.5 | - | 2021-06-02 |
| CVE-2020-14326 | Red Hat Resteasy 安全漏洞 — RESTEasy | 7.5 | - | 2021-06-02 |
| CVE-2021-32657 | Nextcloud 资源管理错误漏洞 — security-advisories | 4.3 | Medium | 2021-06-01 |
| CVE-2021-20237 | ZeroMQ 资源管理错误漏洞 — zeromq | 7.5 | - | 2021-05-28 |
| CVE-2021-20201 | spice 安全漏洞 — spice | 7.5 | - | 2021-05-28 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 2083 条 CVE 漏洞。