CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following example demonstrates the weakness.

Vulnerable example

java

class Worker implements Executor {

There are no limits to runnables. Potentially an attacker could cause resource problems very quickly.

This code allocates a socket and forks each time it receives a new connection.

Vulnerable example

sock=socket(AF_INET, SOCK_STREAM, 0);

The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely.

In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket.

Vulnerable example

int writeDataFromSocketToFile(char *host, int port)

This example creates a situation where data can be dumped to a file on the local file system without any limits on the size of the file. This could potentially exhaust file or disk resources and/or limit other clients' ability to access the service.

In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array.

Vulnerable example

/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be processed */

Safe example

unsigned int length = getMessageLength(message[0]);

In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket.

Vulnerable example

java

public void acceptConnections() {

Safe example

java

public static final int SERVER_PORT = 4444;

In the following example, the serve function receives an http request and an http response writer. It reads the entire request body.

Vulnerable example

func serve(w http.ResponseWriter, r *http.Request) {

Safe example

func serve(w http.ResponseWriter, r *http.Request) {

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2020-3566
CISA KEV
— Resource exhaustion in distributed OS because of "insufficient" IGMP queue management, as exploited in the wild per CISA KEV.
CVE-2019-19911 — Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).
CVE-2020-7218 — Go-based workload orchestrator does not limit resource usage with unauthenticated connections, allowing a DoS by flooding the service
CVE-2009-2874 — Product allows attackers to cause a crash via a large number of connections.
CVE-2009-1928 — Malformed request triggers uncontrolled recursion, leading to stack exhaustion.
CVE-2009-2858 — Chain: memory leak (CWE-404) leads to resource exhaustion.
CVE-2009-2726 — Driver does not use a maximum width when invoking sscanf style functions, causing stack consumption.
CVE-2009-2540 — Large integer value for a length property in an object causes a large amount of memory allocation.
CVE-2009-2299 — Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.
CVE-2009-2054 — Product allows exhaustion of file descriptors when processing a large number of TCP packets.
CVE-2008-5180 — Communication product allows memory consumption with a large number of SIP requests, which cause many sessions to be created.
CVE-2008-2121 — TCP implementation allows attackers to consume CPU and prevent new connections using a TCP SYN flood attack.
CVE-2008-2122 — Port scan triggers CPU consumption with processes that attempt to read data from closed sockets.
CVE-2008-1700 — Product allows attackers to cause a denial of service via a large number of directives, each of which opens a separate window.
CVE-2007-4103 — Product allows resource exhaustion via a large number of calls that do not complete a 3-way handshake.
CVE-2006-1173 — Mail server does not properly handle deeply nested multipart MIME messages, leading to stack exhaustion.
CVE-2007-0897 — Chain: anti-virus product encounters a malformed file but returns from a function without closing a file descriptor (CWE-775) leading to file descriptor consumption (CWE-400) and failed scans.

Frequently asked questions

Common questions about CWE-400.

What is CWE-400?

The product does not properly control the allocation and maintenance of a limited resource.

What CVEs are caused by CWE-400?

2,135 recorded CVEs are attributed to CWE-400, including CVE-2023-38180, CVE-2020-3569, CVE-2004-1464. 7 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Is CWE-400 part of the OWASP Top 10?

CWE-400 maps to OWASP Top Ten 2004: Denial of Service (A9) in the OWASP security taxonomy.

How do you prevent CWE-400?

Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.

How is CWE-400 detected?

Automated Static Analysis: Automated static analysis typically has limited utility in recognizing resource exhaustion problems, except for program-independent system resources such as files, sockets, and processes. For system resources, automated static analysis may be able to detect circumstances in which resources are not released after they have expired. Automated analysis of configuration files may be able to detect settings that do not specify a maximum value.

What are the consequences of CWE-400?

Exploiting CWE-400 can lead to: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Bypass Protection Mechanism, Other.

Is CWE-400 actively exploited?

Yes. 7 CWE-400 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 2,135 recorded CVEs.

Real-world CVEs

CWE-400: Uncontrolled Resource Consumption

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Automated Dynamic Analysis

Fuzzing

Code examples

Illustrative examples

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

What is CWE-400?

What CVEs are caused by CWE-400?

Is CWE-400 part of the OWASP Top 10?

How do you prevent CWE-400?

How is CWE-400 detected?

What are the consequences of CWE-400?

Is CWE-400 actively exploited?

References

Stay ahead of CWE-400

Real-world CVEs

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Automated Dynamic Analysis

Fuzzing

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Related

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

What is CWE-400?

What CVEs are caused by CWE-400?

Is CWE-400 part of the OWASP Top 10?

How do you prevent CWE-400?

How is CWE-400 detected?

What are the consequences of CWE-400?

Is CWE-400 actively exploited?

References

Stay ahead of CWE-400