Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-400 (未加控制的资源消耗(资源穷尽)) — Vulnerability Class 1397

1397 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.

CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.

MITRE CWE Description
The product does not properly control the allocation and maintenance of a limited resource.
Common Consequences (2)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding envir…
Access Control, OtherBypass Protection Mechanism, Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
Mitigations (4)
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perha…
Architecture and DesignMitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to preven…
Architecture and DesignEnsure that protocols have specific limits of scale placed on them.
ImplementationEnsure that all failures in resource allocation place the system into a safe posture.
Examples (2)
The following example demonstrates the weakness.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }
Bad · Java
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2018-3739 https-proxy-agent 安全漏洞 — https-proxy-agent node module 7.5 -2018-06-07
CVE-2017-16013 Hapi 安全漏洞 — hapi node module 7.5 -2018-06-04
CVE-2017-16021 uri-js 安全漏洞 — uri-js node module 6.5 -2018-06-04
CVE-2017-16023 Decamelize 安全漏洞 — decamelize node module 7.5 -2018-06-04
CVE-2017-16025 Nes 安全漏洞 — nes node module 7.5 -2018-06-04
CVE-2017-16030 Useragent 安全漏洞 — useragent node module 7.5 -2018-06-04
CVE-2014-10064 qs模块安全漏洞 — qs node module 7.5 -2018-05-31
CVE-2015-9239 ansi2html 安全漏洞 — ansi2html node module 7.5 -2018-05-31
CVE-2016-10520 jadedown 安全漏洞 — jadedown node module 7.5 -2018-05-31
CVE-2016-10521 jshamcrest 安全漏洞 — jshamcrest node module 7.5 -2018-05-31
CVE-2016-10523 MQTT 安全漏洞 — mqtt-packet node module 7.5 -2018-05-31
CVE-2016-10524 i18n-node-angular 安全漏洞 — i18n-node-angular node module 6.8 -2018-05-31
CVE-2016-10527 riot-compiler 安全漏洞 — riot-compiler node module 7.5 -2018-05-31
CVE-2016-10539 negotiator 安全漏洞 — negotiator node module 7.5 -2018-05-31
CVE-2016-10540 Minimatch 安全漏洞 — minimatch node module 7.5 -2018-05-31
CVE-2016-10542 ws 安全漏洞 — ws node module 7.5 -2018-05-31
CVE-2016-10544 uws 安全漏洞 — uws node module 5.9 -2018-05-31
CVE-2015-9241 hapi node模块安全漏洞 — hapi node module 7.5 -2018-05-29
CVE-2015-9242 ecstatic node模块安全漏洞 — ecstatic node module 7.5 -2018-05-29
CVE-2016-8627 admin-cli 安全漏洞 — admin-cli 6.5 -2018-05-11
CVE-2018-0285 Cisco Prime Service Catalog 安全漏洞 — Cisco Prime Service Catalog 4.3 -2018-05-02
CVE-2018-0230 Cisco Firepower 2100 Series Security Appliances Firepower Threat Defense Software 安全漏洞 — Cisco Firepower 2100 Series Security Appliances 8.6 -2018-04-19
CVE-2018-0233 多款Cisco产品Firepower System Software detection引擎安全漏洞 — Cisco Firepower Detection Engine 8.6 -2018-04-19
CVE-2018-1064 Red Hat libvirt 安全漏洞 — libvirt 7.5 -2018-03-28
CVE-2016-9589 Red Hat Wildfly 安全漏洞 — wildfly 7.5 -2018-03-12
CVE-2017-12174 Artemis和HornetQ 安全漏洞 — HornetQ/Artemis 7.5 -2018-03-07
CVE-2017-15130 Dovecot 安全漏洞 — dovecot 7.5 -2018-03-02
CVE-2017-15133 miekg-dns 安全漏洞 — miekg-dns 7.5 -2018-01-29
CVE-2017-15132 Dovecot auth客户端安全漏洞 — dovecot 7.5 -2018-01-25
CVE-2018-4837 Siemens TeleControl Server Basic 安全漏洞 — TeleControl Server Basic 7.5 -2018-01-25

Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1397 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.