1397 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.
CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2022-38687 | UNISOC chipset 安全漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39123 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39124 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39125 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39126 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39127 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39128 | UNISOC chipset 缓冲区错误漏洞 — SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 | 5.5 | - | 2022-10-14 |
| CVE-2022-39278 | Istio vulnerable to denial of service attack due to Golang Regex Library — istio | 7.5 | High | 2022-10-13 |
| CVE-2022-38371 | Siemens Nucleus NET和Nucleus ReadyStart 资源管理错误漏洞 — APOGEE MBC (PPC) (BACnet) | 7.5 | High | 2022-10-11 |
| CVE-2022-39271 | Traefik HTTP/2 connections management could cause a denial of service — traefik | 7.5 | High | 2022-10-11 |
| CVE-2022-39280 | Regular expression denial of service in dparse — dparse | 5.9 | Medium | 2022-10-06 |
| CVE-2022-3257 | Server-side Denial of Service while processing a specifically crafted GIF file — Mattermost | 3.1 | Low | 2022-09-23 |
| CVE-2022-23951 | Keylime 安全漏洞 — keylime | 8.1 | - | 2022-09-21 |
| CVE-2022-40150 | Stack Buffer Overflow in Jettison — Jettison | 6.5 | Medium | 2022-09-16 |
| CVE-2022-39209 | Uncontrolled Resource Consumption in cmark-gfm — cmark-gfm | 7.5 | High | 2022-09-15 |
| CVE-2022-36114 | Extracting malicious crates can fill the file system — cargo | 4.8 | Medium | 2022-09-14 |
| CVE-2022-2962 | QEMU 缓冲区错误漏洞 — QEMU | 8.8 | - | 2022-09-13 |
| CVE-2022-38100 | Contec Health CMS8000 — CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor | 7.5 | High | 2022-09-13 |
| CVE-2022-39158 | Siemens RUGGEDCOM 资源管理错误漏洞 — RUGGEDCOM i800 | 5.3 | Medium | 2022-09-13 |
| CVE-2022-31006 | Hyperledger Indy DOS vulnerability — indy-node | 7.5 | High | 2022-09-09 |
| CVE-2022-3147 | Server-side Denial of Service while processing a specifically crafted JPEG file — Mattermost | 3.1 | Low | 2022-09-09 |
| CVE-2022-36083 | JOSE vulnerable to resource exhaustion via specifically crafted JWE — jose | 5.3 | Medium | 2022-09-07 |
| CVE-2022-36049 | Flux2 Helm Controller denial of service — flux2 | 7.7 | High | 2022-09-07 |
| CVE-2022-1677 | Red Hat OpenShift Container Platform 资源管理错误漏洞 — Openshift | 7.6 | - | 2022-09-01 |
| CVE-2020-35534 | Libraw 安全漏洞 — LibRaw | 5.5 | - | 2022-09-01 |
| CVE-2022-36055 | Denial of service in Helm — helm | 6.5 | Medium | 2022-09-01 |
| CVE-2022-2764 | Red Hat Undertow 安全漏洞 — undertow | 4.9 | - | 2022-09-01 |
| CVE-2022-2004 | AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption — DirectLOGIC D0-06 series CPUs | 7.5 | High | 2022-08-31 |
| CVE-2022-1325 | GREYC Clmg 安全漏洞 — Clmg | 5.5 | - | 2022-08-31 |
| CVE-2022-1259 | Red Hat Undertow 资源管理错误漏洞 — undertow | 7.5 | - | 2022-08-31 |
Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1397 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.