1622
CAPEC-ID Attack Pattern Name
488 HTTP Flood
489 SSL Flood
490 Amplification
491 Quadratic Data Expansion
493 SOAP Array Blowup
494 TCP Fragmentation
495 UDP Fragmentation
496 ICMP Fragmentation
528 XML Flood
References
[REF-386]Joao Antunes, Nuno Ferreira Neves and Paulo Verissimo. "Detection and Prediction
of Resource-Exhaustion Vulnerabilities". Proceedings of the IEEE International Symposium on
Software Reliability Engineering (ISSRE). 2008 November. < http://homepages.di.fc.ul.pt/~nuno/
PAPERS/ISSRE08.pdf >.
[REF-387]D.J. Bernstein. "Resource exhaustion". < http://cr.yp.to/docs/resources.html >.
[REF-388]Pascal Meunier. "Resource exhaustion". Secure Programming Educational Material.
2004. < http://homes.cerias.purdue.edu/~pmeunier/secprog/sanitized/class1/6.resource
%20exhaustion.ppt >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-667]Rafal Los. "Real-Life Example of a 'Business Logic Defect' (Screen Shots!)". 2011. <
http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-
Logic-Defect-Screen-Shots/ba-p/22581 >.
[REF-672]Frank Kim. "Top 25 Series - Rank 22 - Allocation of Resources Without Limits
or Throttling". 2010 March 3. SANS Software Security Institute. < https://web.archive.org/
web/20170113055136/https://software-security.sans.org/blog/2010/03/23/top-25-series-rank-22-
allocation-of-resources-without-limits-or-throttling/ >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-771: Missing Reference to Active Allocated Resource
Weakness ID : 771
Structure : Simple
Abstraction : Base
Description
The product does not properly maintain a reference to a resource that has been allocated, which
prevents the resource from being reclaimed.
Extended Description
This does not necessarily apply in languages or frameworks that automatically perform garbage
collection, since the removal of all references may act as a signal that the resource is ready to be
reclaimed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-771: Missing Reference to Active Allocated Resource
CWE-771: Missing Reference to Active Allocated Resource