1621
Nature Type ID Name Page
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1148 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 14. Serialization (SER)
1133 2451
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
This entry is different from uncontrolled resource consumption (CWE-400) in that there are other
weaknesses that are related to inability to control resource consumption, such as holding on to a
resource too long after use, or not correctly keeping track of active resources so that they can be
managed and released when they are finished (CWE-771).
Theoretical
Vulnerability theory is largely about how behaviors and resources interact. "Resource
exhaustion" can be regarded as either a consequence or an attack, depending on the
perspective. This entry is an attempt to reflect one of the underlying weaknesses that enable
these attacks (or consequences) to take place.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO04-J Close resources when they are no
longer needed
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER12-J Avoid memory and resource leaks
during serialization
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC05-J Do not exhaust heap space
ISA/IEC 62443 Part 4-2 Req CR 7.2
ISA/IEC 62443 Part 4-2 Req CR 2.7
ISA/IEC 62443 Part 4-1 Req SI-1
ISA/IEC 62443 Part 4-1 Req SI-2
ISA/IEC 62443 Part 3-3 Req SR 7.2
ISA/IEC 62443 Part 3-3 Req SR 2.7
Related Attack Patterns
CAPEC-ID Attack Pattern Name
125 Flooding
130 Excessive Allocation
147 XML Ping of the Death
197 Exponential Data Expansion
229 Serialized Data Parameter Blowup
230 Serialized Data with Nested Payloads
231 Oversized Serialized Data Payloads
469 HTTP DoS
482 TCP Flood
486 UDP Flood
487 ICMP Flood
CWE Version 4.14
CWE-771: Missing Reference to Active Allocated Resource
CWE-771: Missing Reference to Active Allocated Resource