CWE-405 不对称的资源消耗(放大攻击) 类弱点 43 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-405属于非对称资源消耗漏洞，指系统未有效限制攻击者以极小代价引发大量资源消耗的情况。攻击者常利用此缺陷，通过发送少量请求触发服务器非线性的资源激增，导致服务拒绝或性能严重下降。开发者应实施严格的速率限制、资源配额管理及输入验证，确保用户行为与系统开销保持合理比例，从而防止资源被恶意放大利用。
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind( (UDP_IP,UDP_PORT) ) while true: data = sock.recvfrom(1024) if not data: break (requestIP, nameToResolve) = parseUDPpacket(data) record = resolveName(nameToResolve) sendResponse(requestIP,record)function printFile($username,$filename){ //read file into string $file = file_get_contents($filename); if ($file && isOwnerOf($username,$filename)){ echo $file; return true; } else{ echo 'You are not authorized to view this file'; } return false; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-86432 | CommonMark 2.8.3 拒绝服务漏洞 — commonmark | 5.3 | Medium | 2026-09-07 |
| CVE-2026-84310 | pypdf 资源管理错误漏洞 — pypdf | 4.8 | Medium | 2026-09-01 |
| CVE-2026-54874 | OpenSSL 资源管理错误漏洞 — OpenSSL | - | - | 2026-08-25 |
| CVE-2026-23934 | Zabbix 资源管理错误漏洞 — Zabbix | 5.1 | Medium | 2026-08-18 |
| CVE-2026-23930 | Zabbix 资源管理错误漏洞 — Zabbix | 5.3 | Medium | 2026-08-18 |
| CVE-2026-72914 | Mastodon 资源管理错误漏洞 — mastodon | 7.5 | High | 2026-08-10 |
| CVE-2026-54224 | UBB Systems UBB.threads 资源管理错误漏洞 — UBB.threads | - | - | 2026-06-18 |
| CVE-2026-47774 | envoyproxy Envoy 资源管理错误漏洞 — envoy | 7.5 | High | 2026-06-17 |
| CVE-2026-8594 | Text::LineFold 安全漏洞 — Text::LineFold | - | - | 2026-05-30 |
| CVE-2026-45557 | Technitium DNS Server 安全漏洞 — DNS Server | 5.8 | Medium | 2026-05-19 |
| CVE-2026-35665 | OpenClaw 安全漏洞 — OpenClaw | 5.3 | Medium | 2026-04-10 |
| CVE-2026-35626 | OpenClaw 安全漏洞 — OpenClaw | 5.3 | Medium | 2026-04-09 |
| CVE-2026-25611 | MongoDB Server 安全漏洞 — MongoDB Server | 7.5 | High | 2026-02-10 |
| CVE-2026-24324 | SAP BusinessObjects Business Intelligence Platform 安全漏洞 — SAP BusinessObjects Business Intelligence Platform (AdminTools) | 6.5 | Medium | 2026-02-10 |
| CVE-2026-0485 | SAP BusinessObjects BI Platform 安全漏洞 — SAP BusinessObjects BI Platform | 7.5 | High | 2026-02-10 |
| CVE-2026-22775 | Svelte 安全漏洞 — devalue | 7.5 | High | 2026-01-15 |
| CVE-2026-22774 | Svelte 安全漏洞 — devalue | 7.5 | High | 2026-01-15 |
| CVE-2025-68480 | marshmallow 安全漏洞 — marshmallow | 5.3 | Medium | 2025-12-22 |
| CVE-2025-42876 | SAP S/4 HANA 安全漏洞 — SAP S/4 HANA Private Cloud (Financials General Ledger) | 7.1 | High | 2025-12-09 |
| CVE-2025-42874 | SAP NetWeaver 安全漏洞 — SAP NetWeaver (remote service for Xcelsius) | 7.9 | High | 2025-12-09 |
| CVE-2025-42873 | SAP SAPUI5 安全漏洞 — SAPUI5 framework (Markdown-it component) | 5.9 | Medium | 2025-12-09 |
| CVE-2025-66564 | Sigstore Timestamp Authority 安全漏洞 — timestamp-authority | 7.5 | High | 2025-12-04 |
| CVE-2025-66506 | Fulcio 安全漏洞 — fulcio | 7.5 | High | 2025-12-04 |
| CVE-2025-49643 | Zabbix 安全漏洞 — Zabbix | 6.5AI | Medium AI | 2025-12-01 |
| CVE-2025-8677 | ISC BIND 9 安全漏洞 — BIND 9 | 7.5 | High | 2025-10-22 |
| CVE-2025-26516 | NetApp StorageGRID 安全漏洞 — StorageGRID | 5.3 | Medium | 2025-09-19 |
| CVE-2025-31987 | HCL Connections Docs 安全漏洞 — Connections Docs | 4.8 | Medium | 2025-08-14 |
| CVE-2025-53633 | Chall-Manager 安全漏洞 — chall-manager | 9.1AI | Critical AI | 2025-07-10 |
| CVE-2025-30204 | jwt-go 安全漏洞 — jwt | 7.5 | High | 2025-03-21 |
| CVE-2024-11187 | ISC BIND 安全漏洞 — BIND 9 | 7.5 | High | 2025-01-29 |
CWE-405（不对称的资源消耗(放大攻击)） 是常见的弱点类别，本平台收录该类弱点关联的 43 条 CVE 漏洞。