CWE-400 未加控制的资源消耗(资源穷尽) 类弱点 2080 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-400 指资源消耗不受控漏洞，属于资源管理缺陷。攻击者通常通过发送大量请求或构造复杂查询，耗尽服务器 CPU、内存或带宽，导致服务拒绝。开发者应避免此类问题，需实施严格的速率限制、请求大小校验及资源配额管理，并设置合理的超时机制与异常处理逻辑，确保有限资源在预期范围内被安全分配与维护。
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2019-19343 | Red Hat Undertow 资源管理错误漏洞 — Undertow | 7.5 | - | 2021-03-23 |
| CVE-2021-21348 | XStream 资源管理错误漏洞 — xstream | 5.3 | Medium | 2021-03-22 |
| CVE-2021-21341 | XStream 代码问题漏洞 — xstream | 7.5 | High | 2021-03-22 |
| CVE-2021-21267 | Npm Schema-Inspector 资源管理错误漏洞 — schema-inspector | 7.5 | High | 2021-03-19 |
| CVE-2020-27827 | lldpd 资源管理错误漏洞 — lldp/openvswitch | 7.5 | - | 2021-03-18 |
| CVE-2021-21375 | Sauwming pjproject 代码问题漏洞 — pjproject | 6.5 | Medium | 2021-03-10 |
| CVE-2021-20265 | Linux kernel 资源管理错误漏洞 — kernel | 5.5 | - | 2021-03-10 |
| CVE-2021-21369 | Matkt Hyperledger Besu 资源管理错误漏洞 — besu | 6.5 | Medium | 2021-03-09 |
| CVE-2021-22883 | nodejs 资源管理错误漏洞 — Node | 7.5 | - | 2021-03-03 |
| CVE-2021-21274 | Matrix Synapse 资源管理错误漏洞 — synapse | 4.3 | Medium | 2021-02-26 |
| CVE-2020-24686 | PLC 资源管理错误漏洞 — AC500 V2 products with onboard Ethernet | 7.5 | High | 2021-02-26 |
| CVE-2021-21328 | vapor 资源管理错误漏洞 — vapor | 5.3 | Medium | 2021-02-26 |
| CVE-2020-27782 | Red Hat Undertow 资源管理错误漏洞 — Undertow | 7.5 | - | 2021-02-23 |
| CVE-2021-22882 | UniFi Protect 资源管理错误漏洞 — UniFi Protect | 6.5 | - | 2021-02-23 |
| CVE-2021-1378 | Cisco StarOS operating system 资源管理错误漏洞 — Cisco ASR 5000 Series Software | 5.3 | Medium | 2021-02-17 |
| CVE-2021-22553 | Jetty 资源管理错误漏洞 — Gerrit | 6.5 | Medium | 2021-02-17 |
| CVE-2021-21317 | Uap-core 资源管理错误漏洞 — uap-core | 5.3 | Medium | 2021-02-16 |
| CVE-2021-22880 | Postgresql PostgreSQL 资源管理错误漏洞 — https://github.com/rails/rails | 7.5 | - | 2021-02-11 |
| CVE-2020-35498 | Openvswitch 资源管理错误漏洞 — openvswitch | 7.5 | - | 2021-02-11 |
| CVE-2021-21296 | Fleet 安全漏洞 — fleet | 2.7 | Low | 2021-02-10 |
| CVE-2021-21306 | marked 资源管理错误漏洞 — marked | 5.3 | Medium | 2021-02-08 |
| CVE-2021-21240 | httplib2 资源管理错误漏洞 — httplib2 | 7.5 | High | 2021-02-08 |
| CVE-2021-1266 | Cisco Managed Services Accelerator 资源管理错误漏洞 — Cisco Managed Services Accelerator | 4.3 | Medium | 2021-02-04 |
| CVE-2021-21294 | Http4s Blaze 资源管理错误漏洞 — http4s | 7.5 | High | 2021-02-02 |
| CVE-2021-21293 | Http4s Blaze 资源管理错误漏洞 — blaze | 7.5 | High | 2021-02-02 |
| CVE-2021-21285 | Docker 代码问题漏洞 — moby | 6.5 | Medium | 2021-02-02 |
| CVE-2021-21254 | CKEditor 资源管理错误漏洞 — ckeditor5 | 6.5 | Medium | 2021-01-29 |
| CVE-2021-25909 | ZIV 4CCT firmware 资源管理错误漏洞 — 4CCT-EA6-334126BF | 8.6 | High | 2021-01-29 |
| CVE-2021-20185 | Moodle 资源管理错误漏洞 — moodle | 5.3 | - | 2021-01-28 |
| CVE-2021-21271 | Tendermint 资源管理错误漏洞 — tendermint | 6.5 | Medium | 2021-01-26 |
CWE-400（未加控制的资源消耗(资源穷尽)） 是常见的弱点类别，本平台收录该类弱点关联的 2080 条 CVE 漏洞。