COMMON WEAKNESS ENUMERATIONIncomplete

CWE-410

Insufficient Resource Pool

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Abstraction

Class

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Extended description

Frequently the consequence is a "flood" of connection or sessions.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

Lifecycle phase

Operation

Risk

What does successful exploitation lead to?

DoS: Crash, Exit, or RestartOther

Affected security scopes: Availability, Integrity, Other

Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.

Architecture and Design

Architecture and design approach

Detail
Consider implementing a velocity check mechanism which would detect abusive behavior.

Operation

Operational defence

Detail
Consider load balancing as an option to handle heavy loads.

Implementation

Implementation-phase defence

Detail
Make sure that resource handles are properly closed when no longer needed.

Architecture and Design

Architecture and design approach

Detail
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
CWE-410: Common Weakness Enumeration Entry CWE-410 · DayBreach Sözlük · DayBreach