目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-770 不加限制或调节的资源分配 类漏洞列表 1491

CWE-770 不加限制或调节的资源分配 类弱点 1491 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-770 属于资源管理缺陷，指系统在分配可复用资源时未实施限制或节流措施。攻击者通常通过发送大量请求耗尽系统资源，导致拒绝服务或性能瘫痪。开发者应通过设置并发上限、实施速率限制及监控资源使用率来缓解风险，确保关键资源分配受到严格管控，防止恶意滥用。

MITRE CWE 官方描述
CWE：CWE-770 未限制或未节流地分配资源（Allocation of Resources Without Limits or Throttling） 英文：产品代表某个行为者（actor）分配可重用资源或一组资源时，未对可分配资源的大小或数量施加任何预期的限制。
常见影响 (1)
Availability DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
缓解措施 (5)
Requirements Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected …
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
代码示例 (2)
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the da…
int writeDataFromSocketToFile(char *host, int port) { char filename[FILENAME_SIZE]; char buffer[BUFFER_SIZE]; int socket = openSocketConnection(host, port); if (socket < 0) { printf("Unable to open socket connection"); return(FAIL); } if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) { if (openFileToWrite(filename) > 0) { while (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){ if (!(writeToFile(buffer) > 0)) break; } } closeFile(); } closeSocket(socket); }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-65654 Ringpop-go 入站成员 gossip 未执行标签限制 — temporalio/ringpop-go 8.7 High 2026-09-21
CVE-2026-93838 SGLang 0.5.20 内存无限分配漏洞 — sglang 5.9 Medium 2026-09-18
CVE-2026-64847 AnyIO进程池未排空标准错误导致阻塞漏洞 — anyio 6.8 Medium 2026-09-18
CVE-2026-91149 Cockpit 无界连接线程生成拒绝服务漏洞 — Red Hat Enterprise Linux 10 7.5 High 2026-09-18
CVE-2026-84447 libheif 间接引用链导致拒绝服务漏洞 — libheif 7.5 High 2026-09-18
CVE-2026-93688 SGLang 0.5.19 无界内存分配漏洞 — sglang 7.5 High 2026-09-18
CVE-2026-10832 Wildfly Elytron ASN.1 无界内存分配漏洞 — Red Hat JBoss Enterprise Application Platform 8.1.8.GA 5.9 Medium 2026-09-18
CVE-2026-93491 Netty HTTPServerCodec 拒绝服务漏洞 — Red Hat Build of Apache Camel 3.33.3.SP2 7.5 High 2026-09-18
CVE-2026-93488 Netty 远程拒绝服务漏洞 — Red Hat Build of Apache Camel 3.33.3.SP2 7.5 High 2026-09-18
CVE-2026-93572 Netty redisarrayaggregator 预分配限制漏洞 — Red Hat build of Apache Camel for Spring Boot 4 7.5 High 2026-09-18
CVE-2026-93310 O-RAN-SC SMO OAM VES Collector资源分配漏洞 — SMO OAM 5.3 Medium 2026-09-18
CVE-2026-93309 O-RAN-SC SMO OAM VES Collector资源分配漏洞 — SMO OAM 4.3 Medium 2026-09-17
CVE-2026-93308 O-RAN-SC SMO OAM VES Collector 资源分配错误 — SMO OAM 4.3 Medium 2026-09-17
CVE-2026-50277 dd-trace-cpp W3C baggage 解析拒绝服务漏洞 — dd-trace-cpp 7.5 High 2026-09-17
CVE-2026-50275 Datadog PHP Tracer W3C baggage解析拒绝服务漏洞 — dd-trace-php 7.5 High 2026-09-17
CVE-2026-54716 Valhalla 退化多边形处理内存溢出漏洞 — valhalla 7.5 High 2026-09-17
CVE-2026-87742 Quarkus-websockets-next 消息缓冲拒绝服务漏洞 — Red Hat build of Quarkus 3.27.5.SP2 7.5 High 2026-09-17
CVE-2026-92961 vm2 3.11.6 之前内存耗尽 DoS 漏洞 — vm2 7.5 High 2026-09-17
CVE-2026-92915 WWBN AVideo userVerifyEmail 未认证访问控制漏洞 — AVideo 7.3 High 2026-09-17
CVE-2026-25281 OOBM 资源分配无限制或节流漏洞 — Snapdragon 7.4 High 2026-09-17
CVE-2026-82399 CoreDNS 自定义传输未认证内存耗尽漏洞 — coredns 7.5 High 2026-09-16
CVE-2026-81176 Svelte devalue 恶意输入拒绝服务漏洞 — devalue 5.3 Medium 2026-09-16
CVE-2026-75516 RabbitMQ Java客户端OOM漏洞 — rabbitmq-java-client 8.7 High 2026-09-16
CVE-2026-57173 vLLM 未认证音频解压炸弹拒绝服务漏洞 — vllm 6.5 Medium 2026-09-16
CVE-2026-77409 RabbitMQ amqp091-go 拒绝服务漏洞 — amqp091-go 8.2 High 2026-09-16
CVE-2026-77403 RabbitMQ amqp091-go 拒绝服务漏洞 — amqp091-go 8.9 High 2026-09-16
CVE-2026-85501 DNSSEC算法复杂度攻击漏洞 — Unbound 5.3 Medium 2026-09-16
CVE-2026-80225 TCP/DoT 持续查询导致服务性能下降 — Unbound 5.3 Medium 2026-09-16
CVE-2025-14871 GitLab 资源分配无限制漏洞 — GitLab 7.5 High 2026-09-16
CVE-2026-1168 GitLab 资源分配无限制漏洞 — GitLab 7.5 High 2026-09-16

CWE-770（不加限制或调节的资源分配） 是常见的弱点类别，本平台收录该类弱点关联的 1491 条 CVE 漏洞。