1420 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.
CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2018-5390 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service — Linux Kernel | 7.5 | - | 2018-08-06 |
| CVE-2016-8611 | OpenStack Glance 输入验证错误漏洞 — openstack-glance | 6.5 | - | 2018-07-31 |
| CVE-2018-10607 | Martem GW6和GWM 安全漏洞 — TELEM GW6 | 7.5 | - | 2018-07-31 |
| CVE-2017-15119 | QEMU 安全漏洞 — qemu | 7.5 | - | 2018-07-27 |
| CVE-2018-10632 | Moxa NPort 5210、5230和5232 安全漏洞 — NPort 5210, 5230, and 5232 | 7.5 | - | 2018-07-24 |
| CVE-2018-10608 | SEL AcSELerator Architect 安全漏洞 — AcSELerator Architect | 6.5 | - | 2018-07-24 |
| CVE-2018-0372 | Cisco Nexus 9000 Series Fabric Switches 安全漏洞 — Cisco Nexus 9000 Series unknown | 7.5 | - | 2018-07-18 |
| CVE-2018-3767 | memjs 安全漏洞 — memjs | 9.1 | - | 2018-07-05 |
| CVE-2018-0309 | Cisco Nexus 3000和9000 Series Switches NX-OS 安全漏洞 — Cisco Nexus 3000 and 9000 unknown | 7.7 | - | 2018-06-21 |
| CVE-2017-16086 | ua-parser 安全漏洞 — ua-parser node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16098 | charset 安全漏洞 — charset node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16099 | no-case模块安全漏洞 — no-case node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16111 | content模块安全漏洞 — content node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16113 | parsejson模块安全漏洞 — parsejson node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16114 | marked模块安全漏洞 — marked node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16115 | timespan模块安全漏洞 — timespan node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16116 | string模块安全漏洞 — string node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16117 | slug 安全漏洞 — slug node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16118 | forwarded模块安全漏洞 — forwarded node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16119 | Fresh 安全漏洞 — fresh node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16136 | method-override 安全漏洞 — method-override node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16137 | debug模块安全漏洞 — debug node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16138 | mime模块安全漏洞 — mime node module | 7.5 | - | 2018-06-07 |
| CVE-2018-3739 | https-proxy-agent 安全漏洞 — https-proxy-agent node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16013 | Hapi 安全漏洞 — hapi node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16021 | uri-js 安全漏洞 — uri-js node module | 6.5 | - | 2018-06-04 |
| CVE-2017-16023 | Decamelize 安全漏洞 — decamelize node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16025 | Nes 安全漏洞 — nes node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16030 | Useragent 安全漏洞 — useragent node module | 7.5 | - | 2018-06-04 |
| CVE-2014-10064 | qs模块安全漏洞 — qs node module | 7.5 | - | 2018-05-31 |
Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1420 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.