1397 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.
CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2018-3739 | https-proxy-agent 安全漏洞 — https-proxy-agent node module | 7.5 | - | 2018-06-07 |
| CVE-2017-16013 | Hapi 安全漏洞 — hapi node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16021 | uri-js 安全漏洞 — uri-js node module | 6.5 | - | 2018-06-04 |
| CVE-2017-16023 | Decamelize 安全漏洞 — decamelize node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16025 | Nes 安全漏洞 — nes node module | 7.5 | - | 2018-06-04 |
| CVE-2017-16030 | Useragent 安全漏洞 — useragent node module | 7.5 | - | 2018-06-04 |
| CVE-2014-10064 | qs模块安全漏洞 — qs node module | 7.5 | - | 2018-05-31 |
| CVE-2015-9239 | ansi2html 安全漏洞 — ansi2html node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10520 | jadedown 安全漏洞 — jadedown node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10521 | jshamcrest 安全漏洞 — jshamcrest node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10523 | MQTT 安全漏洞 — mqtt-packet node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10524 | i18n-node-angular 安全漏洞 — i18n-node-angular node module | 6.8 | - | 2018-05-31 |
| CVE-2016-10527 | riot-compiler 安全漏洞 — riot-compiler node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10539 | negotiator 安全漏洞 — negotiator node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10540 | Minimatch 安全漏洞 — minimatch node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10542 | ws 安全漏洞 — ws node module | 7.5 | - | 2018-05-31 |
| CVE-2016-10544 | uws 安全漏洞 — uws node module | 5.9 | - | 2018-05-31 |
| CVE-2015-9241 | hapi node模块安全漏洞 — hapi node module | 7.5 | - | 2018-05-29 |
| CVE-2015-9242 | ecstatic node模块安全漏洞 — ecstatic node module | 7.5 | - | 2018-05-29 |
| CVE-2016-8627 | admin-cli 安全漏洞 — admin-cli | 6.5 | - | 2018-05-11 |
| CVE-2018-0285 | Cisco Prime Service Catalog 安全漏洞 — Cisco Prime Service Catalog | 4.3 | - | 2018-05-02 |
| CVE-2018-0230 | Cisco Firepower 2100 Series Security Appliances Firepower Threat Defense Software 安全漏洞 — Cisco Firepower 2100 Series Security Appliances | 8.6 | - | 2018-04-19 |
| CVE-2018-0233 | 多款Cisco产品Firepower System Software detection引擎安全漏洞 — Cisco Firepower Detection Engine | 8.6 | - | 2018-04-19 |
| CVE-2018-1064 | Red Hat libvirt 安全漏洞 — libvirt | 7.5 | - | 2018-03-28 |
| CVE-2016-9589 | Red Hat Wildfly 安全漏洞 — wildfly | 7.5 | - | 2018-03-12 |
| CVE-2017-12174 | Artemis和HornetQ 安全漏洞 — HornetQ/Artemis | 7.5 | - | 2018-03-07 |
| CVE-2017-15130 | Dovecot 安全漏洞 — dovecot | 7.5 | - | 2018-03-02 |
| CVE-2017-15133 | miekg-dns 安全漏洞 — miekg-dns | 7.5 | - | 2018-01-29 |
| CVE-2017-15132 | Dovecot auth客户端安全漏洞 — dovecot | 7.5 | - | 2018-01-25 |
| CVE-2018-4837 | Siemens TeleControl Server Basic 安全漏洞 — TeleControl Server Basic | 7.5 | - | 2018-01-25 |
Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1397 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.