CWE-410: Insufficient Resource Pool
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Last updated
Overview
Frequently the consequence is a "flood" of connection or sessions.
Real-world CVEs
20 recorded CVEs are caused by CWE-410 (Insufficient Resource Pool). The highest-severity and most recent are shown first. 3 new CWE-410 CVEs have been recorded so far in 2026 (6 in 2025).
- CVE-2021-1615
Cisco Embedded Wireless Controller Software for Catalyst Access Points Denial of Service Vulnerability
High · CVSS 8.6 · EPSS 69th2021-09-23 - CVE-2025-41653
Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches
High · CVSS 7.5 · EPSS 46th2025-05-27 - CVE-2025-27479
Kerberos Key Distribution Proxy Service Denial of Service Vulnerability
High · CVSS 7.5 · EPSS 80th2025-04-08 - CVE-2025-27694High · CVSS 7.5 · EPSS 36th2025-04-02
- CVE-2025-0453
Denial of Service through Batched Queries in GraphQL in mlflow/mlflow
High · CVSS 7.5 · EPSS 96th2025-03-20 - CVE-2022-40224High · CVSS 7.5 · EPSS 99th2023-02-07
- CVE-2022-46679High · CVSS 7.5 · EPSS 53th2023-02-01
- CVE-2022-2048High · CVSS 7.5 · EPSS 82th2022-07-07
- CVE-2019-13921High · CVSS 7.5 · EPSS 70th2019-10-10
- CVE-2019-0056High · CVSS 7.5 · EPSS 69th2019-10-09
- CVE-2018-13815High · CVSS 7.5 · EPSS 77th2018-12-13
- CVE-2024-7392Medium · CVSS 6.5 · EPSS 44th2024-11-22
Showing 12 of 20 recorded CWE-410 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-410 vulnerabilitiesCommon consequences
What can happen when CWE-410 is exploited.
DoS: Crash, Exit, or Restart, Other
Affects: Availability, Integrity, Other
Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-410, grouped by where in the lifecycle they apply.
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Consider implementing a velocity check mechanism which would detect abusive behavior.
Consider load balancing as an option to handle heavy loads.
Make sure that resource handles are properly closed when no longer needed.
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial for an attacker to instigate a denial of service (DoS) by using up all of the available connections in the pool.
Vulnerable example
<Resource name="jdbc/exampledb"Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-1999-1363 — Large number of locks on file exhausts the pool and causes crash.
- CVE-2001-1340 — Product supports only one connection and does not disconnect a user who does not provide credentials.
- CVE-2002-0406 — Large number of connections without providing credentials allows connection exhaustion.
Terminology & mappings
Mapped taxonomies
- PLOVER: Insufficient Resource Pool
- OWASP Top Ten 2004: Denial of Service (A9) — CWE More Specific fit
- The CERT Oracle Secure Coding Standard for Java (2011): Use thread pools to enable graceful degradation of service during traffic bursts (TPS00-J)
Frequently asked questions
Common questions about CWE-410.
- What is CWE-410?
- The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
- What CVEs are caused by CWE-410?
- 20 recorded CVEs are attributed to CWE-410, including CVE-2021-1615, CVE-2025-41653, CVE-2025-27479.
- Is CWE-410 part of the OWASP Top 10?
- CWE-410 maps to OWASP Top Ten 2004: Denial of Service (A9) in the OWASP security taxonomy.
- How do you prevent CWE-410?
- Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
- What are the consequences of CWE-410?
- Exploiting CWE-410 can lead to: DoS: Crash, Exit, or Restart, Other.
- Is CWE-410 actively exploited?
- 20 recorded CVEs are caused by CWE-410; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-410) (opens in a new tab)
- CWE-410 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-410
Get alerted the moment a new CWE-410 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.