CWE-774 (不加限制或调节进行文件描述符或句柄的分配) — Vulnerability Class 1

CWE-774 represents a resource management weakness where software fails to enforce limits on file descriptor or handle allocations for specific actors. This vulnerability typically arises when applications accept untrusted input or process external requests without capping the number of open files, allowing malicious users to exhaust system resources. By rapidly opening numerous connections or files, an attacker can trigger a denial-of-service condition, preventing legitimate processes from accessing critical data or performing essential operations. To mitigate this risk, developers must implement strict throttling mechanisms and enforce quotas on resource consumption per user or session. Utilizing operating system-level limits, such as ulimit in Unix-like systems, and integrating application-level counters ensures that resource exhaustion is prevented, maintaining system stability and availability against abuse.