The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Frequently the consequence is a "flood" of connection or sessions.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| CanPrecede | Discouraged | C | 400 | Uncontrolled Resource Consumption |
| ChildOf | Discouraged | P | 664 | Improper Control of a Resource Through its Lifetime |
| ParentOf | Allowed | B | 412 | Unrestricted Externally Accessible Lock |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 399 | Resource Management Errors |
| MemberOf | Prohibited | C | 730 | OWASP Top Ten 2004 Category A9 - Denial of Service |
| MemberOf | Prohibited | C | 855 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS) |
| MemberOf | Prohibited | C | 977 | SFP Secondary Cluster: Design |
| MemberOf | Prohibited | C | 1145 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) |
| MemberOf | Prohibited | C | 1416 | Comprehensive Categorization: Resource Lifecycle Management |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-312 | Other (impact) |
| MemberOf | Prohibited | BS | BOSS-324 | DoS: Crash, Exit, or Restart (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1145 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 399 | Resource Management Errors |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 977 | SFP Secondary Cluster: Design |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| AvailabilityIntegrityOther | N/A | DoS: Crash, Exit, or RestartOther | Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool. |
Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Consider implementing a velocity check mechanism which would detect abusive behavior.
Consider load balancing as an option to handle heavy loads.
Make sure that resource handles are properly closed when no longer needed.
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
N/A
N/A
N/A
In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial for an attacker to instigate a denial of service (DoS) by using up all of the available connections in the pool.
| Reference | Description |
|---|---|
| CVE-1999-1363 | Large number of locks on file exhausts the pool and causes crash. |
| CVE-2001-1340 | Product supports only one connection and does not disconnect a user who does not provide credentials. |
| CVE-2002-0406 | Large number of connections without providing credentials allows connection exhaustion. |
| Ordinality | Description |
|---|
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Insufficient Resource Pool |
| OWASP Top Ten 2004 | A9 | CWE More Specific | Denial of Service |
| The CERT Oracle Secure Coding Standard for Java (2011) | TPS00-J | N/A | Use thread pools to enable graceful degradation of service during traffic bursts |
| ID | Name |
|---|