CWE-400: Uncontrolled Resource Consumption

This weakness occurs when an actor can cause a product to allocate or retain a limited resource without suitable limits on quantity, size, rate, or duration. Resources may be consumed because excessive requests are not throttled, resources are not closed or returned, references are lost before release, or failures are handled unsafely. The usual result is degraded or lost availability, but resource exhaustion can sometimes cause the product to fail open and weaken security protections.

The weakness arises when the system does not limit the number or size of allocated resources, fails to release resources at the proper time, or loses all references to resources before cleanup. Common causes include missing throttling, failure to close or return resources after processing, and incorrect handling of errors or exceptional conditions because responsibility for releasing the resource is unclear. It can be introduced through operation or configuration when resource limits are lower than expected, as well as through design and implementation decisions that do not handle excessive requests safely.

The primary consequence is an availability impact, including denial of service through crashes, exits, restarts, or consumption of CPU, memory, and other resources. Legitimate users may be slowed down or locked out, and resource exhaustion can also affect the surrounding host environment. In some cases, the product may fail open, allowing a protection mechanism to be bypassed or otherwise compromising security functionality.

Design and limit consumption. Build throttling into the architecture, limit the amount of resources an unauthorized user can cause to be consumed, and place explicit scale limits on protocols. Use strong authentication and access control, protect login functionality against denial of service, consider caching database result sets, and track request rates so requests exceeding a defined threshold can be blocked.

The system can recognize an attack and deny further access for a period, or uniformly throttle requests so resources cannot be consumed faster than they are released. The first approach can itself deny service to a legitimate user, especially if an attacker impersonates that user, while uniform throttling is difficult to implement and only raises the attack cost rather than fully solving the problem. Ensure that every resource-allocation failure leaves the system in a safe posture.

Automated static analysis has limited utility and is mainly applicable to system resources such as files, sockets, and processes. It may identify resources that are not released after expiration or configuration settings without a maximum value, but it is generally unsuitable for custom resources such as a policy limiting a user's posts per day.

Automated dynamic analysis has moderate effectiveness for processes, memory, and connections by generating many requests within a short period. Fuzzing can find resource exhaustion opportunistically when many test cases run without restarting the target; an intermittent crash may indicate that the product cannot handle accumulated resource exhaustion. These approaches are not complete guarantees and may miss weaknesses involving custom resource policies or scenarios not exercised by the tests.

The following are representative examples, not an exhaustive list:

• CVE-2019-19911: a Python library processes images with a very large number of bands without limiting resources, leading to excessive memory consumption or an integer overflow.
• CVE-2020-7218: a Go-based workload orchestrator does not limit resource usage for unauthenticated connections, allowing denial of service through service flooding.
• CVE-2020-3566: insufficient IGMP queue management in a distributed operating system results in resource exhaustion.
• CVE-2009-2874, CVE-2007-4103, and CVE-2008-2121: these illustrate exhaustion caused by large numbers of connections, incomplete three-way handshakes, and a TCP SYN flood that consumes CPU.
• CVE-2009-1928 and CVE-2006-1173: deeply nested requests or data exhaust the stack through uncontrolled recursion or deeply nested MIME messages.
• CVE-2009-2858 and CVE-2007-0897: a memory leak or failure to close a file descriptor leads to resource exhaustion and processing failures.
• CVE-2009-2726, CVE-2009-2540, and CVE-2009-2299: large inputs or unrestricted length values cause excessive stack or memory consumption.
• CVE-2009-2054, CVE-2008-5180, CVE-2008-2122, and CVE-2007-0897: file descriptors, memory, CPU, or session resources are exhausted by large numbers of packets, requests, processes, or sessions.