目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

CWE-770 不加限制或调节的资源分配 类漏洞列表 915

CWE-770 不加限制或调节的资源分配 类弱点 915 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-770 属于资源管理缺陷，指系统在分配可复用资源时未实施限制或节流措施。攻击者通常通过发送大量请求耗尽系统资源，导致拒绝服务或性能瘫痪。开发者应通过设置并发上限、实施速率限制及监控资源使用率来缓解风险，确保关键资源分配受到严格管控，防止恶意滥用。

MITRE CWE 官方描述
CWE：CWE-770 未限制或未节流地分配资源（Allocation of Resources Without Limits or Throttling） 英文：产品代表某个行为者（actor）分配可重用资源或一组资源时，未对可分配资源的大小或数量施加任何预期的限制。
常见影响 (1)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
缓解措施 (5)
RequirementsClearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and DesignLimit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected …
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
代码示例 (2)
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the da…
int writeDataFromSocketToFile(char *host, int port) { char filename[FILENAME_SIZE]; char buffer[BUFFER_SIZE]; int socket = openSocketConnection(host, port); if (socket < 0) { printf("Unable to open socket connection"); return(FAIL); } if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) { if (openFileToWrite(filename) > 0) { while (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){ if (!(writeToFile(buffer) > 0)) break; } } closeFile(); } closeSocket(socket); }
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2026-41710 VMware Spring Retry 安全漏洞 — Spring Retry 5.9 Medium2026-06-09
CVE-2026-43973 Gun 安全漏洞 — gun--2026-06-08
CVE-2026-45290 Cloudburst Network 安全漏洞 — Network 7.5 High2026-06-05
CVE-2026-50589 OpenStack Ironic 安全漏洞 — Ironic 5.3 Medium2026-06-04
CVE-2026-40898 quic-go 安全漏洞 — quic-go 5.3 Medium2026-06-04
CVE-2025-46638 Dell BSAFE 安全漏洞 — BSAFE SSL-J 7.5 High2026-06-04
CVE-2026-44545 daphne 安全漏洞 — daphne 5.3 Medium2026-06-03
CVE-2026-28299 SolarWinds Web Help Desk 安全漏洞 — Web Help Desk 8.2 High2026-06-02
CVE-2026-48597 Tesla 安全漏洞 — tesla--2026-06-02
CVE-2026-34077 react-router 安全漏洞 — react-router 7.5 High2026-06-02
CVE-2026-49754 Mint 安全漏洞 — mint--2026-06-02
CVE-2026-48862 Mint 安全漏洞 — mint--2026-06-02
CVE-2026-49140 nanobot 安全漏洞 — nanobot 4.3 Medium2026-06-01
CVE-2026-40990 VMware Spring Cloud Function 安全漏洞 — Spring Cloud Function 5.7 Medium2026-06-01
CVE-2026-10533 Red Hat OpenShift Container Platform 安全漏洞 — Red Hat OpenShift Container Platform 4 5.0 Medium2026-06-01
CVE-2026-49361 Apache Fluss 安全漏洞 — Apache Fluss (incubating)--2026-06-01
CVE-2026-45023 AutoGPT 安全漏洞 — AutoGPT 5.4 Medium2026-05-28
CVE-2026-45292 OpenTelemetry 安全漏洞 — opentelemetry-java 5.3 Medium2026-05-28
CVE-2026-45078 synapse 安全漏洞 — synapse--2026-05-28
CVE-2026-48735 pypdf 安全漏洞 — pypdf--2026-05-28
CVE-2026-1402 GitLab 安全漏洞 — GitLab 6.5 Medium2026-05-27
CVE-2026-6053 IBM Db2 安全漏洞 — Db2 5.5 Medium2026-05-27
CVE-2026-1718 IBM Db2 安全漏洞 — Db2 7.1 High2026-05-27
CVE-2025-11482 B&R Industrial Automation PPT30 Operating System 安全漏洞 — PPT30 Operating System 7.5 High2026-05-26
CVE-2026-47067 Hackney 安全漏洞 — hackney--2026-05-25
CVE-2026-44070 Netatalk 安全漏洞 — Netatalk 3.1 Low2026-05-21
CVE-2026-8488 Progress Software MOVEit 安全漏洞 — MOVEit Automation 4.3 Medium2026-05-20
CVE-2026-8486 Progress Software MOVEit 安全漏洞 — MOVEit Automation 5.3 Medium2026-05-20
CVE-2026-8469 PhoenixStorybook 安全漏洞 — phoenix_storybook--2026-05-20
CVE-2026-9064 389 Directory Server 安全漏洞 — Red Hat Directory Server 11.5 E4S for RHEL 8 7.5 High2026-05-20

CWE-770（不加限制或调节的资源分配） 是常见的弱点类别，本平台收录该类弱点关联的 915 条 CVE 漏洞。