Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-400 (未加控制的资源消耗(资源穷尽)) — Vulnerability Class 1397

1397 vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)). AI Chinese analysis included.

CWE-400 represents a critical resource management weakness where software fails to properly control the allocation and maintenance of finite system resources, such as memory, CPU cycles, or file descriptors. Attackers typically exploit this vulnerability by triggering actions that consume excessive resources, leading to denial-of-service conditions that degrade performance or crash the application entirely. This often occurs through crafted inputs that force infinite loops, excessive data processing, or unbounded memory allocation. To mitigate this risk, developers must implement strict resource limits, including timeouts, maximum iteration counts, and memory caps. Additionally, employing robust input validation and monitoring tools helps detect abnormal consumption patterns early. By enforcing these controls, engineers ensure that applications remain resilient against resource exhaustion attacks, maintaining availability and stability even under malicious stress or unexpected load spikes.

MITRE CWE Description
The product does not properly control the allocation and maintenance of a limited resource.
Common Consequences (2)
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
If an attacker can trigger the allocation of the limited resources, but the number or size of the resources is not controlled, then the most common result is denial of service. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding envir…
Access Control, OtherBypass Protection Mechanism, Other
In some cases it may be possible to force the product to "fail open" in the event of resource exhaustion. The state of the product -- and possibly the security functionality - may then be compromised.
Mitigations (4)
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perha…
Architecture and DesignMitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to preven…
Architecture and DesignEnsure that protocols have specific limits of scale placed on them.
ImplementationEnsure that all failures in resource allocation place the system into a safe posture.
Examples (2)
The following example demonstrates the weakness.
class Worker implements Executor { ... public void execute(Runnable r) { try { ... } catch (InterruptedException ie) { // postpone response Thread.currentThread().interrupt(); } } public Worker(Channel ch, int nworkers) { ... } protected void activate() { Runnable loop = new Runnable() { public void run() { try { for (;;) { Runnable r = ...; r.run(); } } catch (InterruptedException ie) { ... } } }; new Thread(loop).start(); } }
Bad · Java
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2018-0086 Cisco Unified Customer Voice Portal application server 安全漏洞 — Cisco Unified Customer Voice Portal 8.6 -2018-01-18
CVE-2017-12741 多款Siemens产品资源管理错误漏洞 — Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller 7.5 High2017-12-26
CVE-2017-12190 Linux kernel 资源管理错误漏洞 — Linux kernel through v4.14-rc5 6.5 -2017-11-22
CVE-2017-14028 Moxa NPort 5110、5130和5150 安全漏洞 — Moxa NPort 5110, 5130, and 5150 7.5 -2017-11-16
CVE-2016-8610 OpenSSL 资源管理错误漏洞 — OpenSSL 7.5 -2017-11-13
CVE-2017-9627 Schneider Electric Wonderware ArchestrA Logger 安全漏洞 — Schneider Electric Wonderware ArchestrA Logger 7.7 -2017-07-07
CVE-2017-6017 多款Schneider Electric产品安全漏洞 — Schneider Electric Modicon M340 PLC 7.5 -2017-06-30
CVE-2017-7521 OpenVPN 安全漏洞 — OpenVPN 5.9 -2017-06-27
CVE-2017-6043 Trihedral VTScada 安全漏洞 — Trihedral VTScada 7.5 -2017-06-21
CVE-2017-7935 Phoenix Contact GmbH mGuard 资源管理错误漏洞 — Phoenix Contact GmbH mGuard 7.5 -2017-05-19
CVE-2017-2681 多款Siemens产品资源管理错误漏洞 — Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller 6.5 Medium2017-05-11
CVE-2017-2680 Siemens SIMATIC 资源管理错误漏洞 — Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller 6.5 Medium2017-05-11
CVE-2017-6024 多款Rockwell Automation产品安全漏洞 — Rockwell Automation ControlLogix 5580 and CompactLogix 5380 5.9 -2017-05-06
CVE-2017-6019 Schneider Electric Conext ComBox 865-1058 安全漏洞 — Schneider Electric Conext ComBox 7.5 -2017-04-07
CVE-2014-5418 GE Multilink Uncontrolled Resource Consumption — Multilink ML800/1200/1600/2400 7.5 -2015-01-17
CVE-2014-2342 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion — SCADA Data Gateway 7.5 -2014-05-30
CVE-2014-2343 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion — SCADA Data Gateway 4.6 -2014-05-30

Vulnerabilities classified as CWE-400 (未加控制的资源消耗(资源穷尽)) represent 1397 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.