964
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-961]Object Management Group (OMG). "Automated Source Code Reliability Measure
(ASCRM)". 2016 January. < http://www.omg.org/spec/ASCRM/1.0/ >.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-400: Uncontrolled Resource Consumption
Weakness ID : 400
Structure : Simple
Abstraction : Class
Description
The product does not properly control the allocation and maintenance of a limited resource, thereby
enabling an actor to influence the amount of resources consumed, eventually leading to the
exhaustion of available resources.
Extended Description
Limited resources include memory, file system storage, database connection pool entries, and
CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of
the resources is not controlled, then the attacker could cause a denial of service that consumes
all available resources. This would prevent valid users from accessing the product, and it could
potentially have an impact on the surrounding environment. For example, a memory exhaustion
attack against an application could slow down the application as well as its host operating system.
There are at least three distinct scenarios which can commonly lead to resource exhaustion:
• Lack of throttling for the number of allocated resources
• Losing all references to a resource before reaching the shutdown stage
• Not closing/returning a resource after processing
Resource exhaustion problems are often result due to an incorrect implementation of the following
situations:
• Error conditions and other exceptional circumstances.
• Confusion over which part of the program is responsible for releasing the resource.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 664 Improper Control of a Resource Through its Lifetime 1454
ParentOf 405 Asymmetric Resource Consumption (Amplification) 986
ParentOf 770 Allocation of Resources Without Limits or Throttling 1613
ParentOf 771 Missing Reference to Active Allocated Resource 1622
CWE Version 4.14
CWE-400: Uncontrolled Resource Consumption
CWE-400: Uncontrolled Resource Consumption