970
}
Because ReadAll is defined to read from src until EOF, it does not treat an EOF from Read as an
error to be reported. This example creates a situation where the length of the body supplied can be
very large and will consume excessive memory, exhausting system resources. This can be avoided
by ensuring the body does not exceed a predetermined length of bytes.
MaxBytesReader prevents clients from accidentally or maliciously sending a large request and
wasting server resources. If possible, the code could be changed to tell ResponseWriter to close
the connection after the limit has been reached.
Example Language: Go (Good)
func serve(w http.ResponseWriter, r *http.Request) {
var body []byte
const MaxRespBodyLength = 1e6
if r.Body != nil {
r.Body = http.MaxBytesReader(w, r.Body, MaxRespBodyLength)
if data, err := io.ReadAll(r.Body); err == nil {
body = data
}
}
}
Observed Examples
Reference Description
CVE-2022-21668 Chain: Python library does not limit the resources used to process images
that specify a very large number of bands (CWE-1284), leading to excessive
memory consumption (CWE-789) or an integer overflow (CWE-190).
https://www.cve.org/CVERecord?id=CVE-2022-21668
CVE-2020-7218 Go-based workload orchestrator does not limit resource usage with
unauthenticated connections, allowing a DoS by flooding the service
https://www.cve.org/CVERecord?id=CVE-2020-7218
CVE-2020-3566 Resource exhaustion in distributed OS because of "insufficient" IGMP queue
management, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-3566
CVE-2009-2874 Product allows attackers to cause a crash via a large number of connections.
https://www.cve.org/CVERecord?id=CVE-2009-2874
CVE-2009-1928 Malformed request triggers uncontrolled recursion, leading to stack exhaustion.
https://www.cve.org/CVERecord?id=CVE-2009-1928
CVE-2009-2858 Chain: memory leak (CWE-404) leads to resource exhaustion.
https://www.cve.org/CVERecord?id=CVE-2009-2858
CVE-2009-2726 Driver does not use a maximum width when invoking sscanf style functions,
causing stack consumption.
https://www.cve.org/CVERecord?id=CVE-2009-2726
CVE-2009-2540 Large integer value for a length property in an object causes a large amount of
memory allocation.
https://www.cve.org/CVERecord?id=CVE-2009-2540
CVE-2009-2299 Web application firewall consumes excessive memory when an HTTP request
contains a large Content-Length value but no POST data.
https://www.cve.org/CVERecord?id=CVE-2009-2299
CVE-2009-2054 Product allows exhaustion of file descriptors when processing a large number
of TCP packets.
https://www.cve.org/CVERecord?id=CVE-2009-2054
CVE-2008-5180 Communication product allows memory consumption with a large number of
SIP requests, which cause many sessions to be created.
https://www.cve.org/CVERecord?id=CVE-2008-5180
CWE Version 4.14
CWE-400: Uncontrolled Resource Consumption
CWE-400: Uncontrolled Resource Consumption