973
CAPEC-ID Attack Pattern Name
492 Regular Expression Exponential Blowup
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-386]Joao Antunes, Nuno Ferreira Neves and Paulo Verissimo. "Detection and Prediction
of Resource-Exhaustion Vulnerabilities". Proceedings of the IEEE International Symposium on
Software Reliability Engineering (ISSRE). 2008 November. < http://homepages.di.fc.ul.pt/~nuno/
PAPERS/ISSRE08.pdf >.
[REF-387]D.J. Bernstein. "Resource exhaustion". < http://cr.yp.to/docs/resources.html >.
[REF-388]Pascal Meunier. "Resource exhaustion". Secure Programming Educational Material.
2004. < http://homes.cerias.purdue.edu/~pmeunier/secprog/sanitized/class1/6.resource
%20exhaustion.ppt >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-401: Missing Release of Memory after Effective Lifetime
Weakness ID : 401
Structure : Simple
Abstraction : Variant
Description
The product does not sufficiently track and release allocated memory after it has been used, which
slowly consumes remaining memory.
Extended Description
This is often triggered by improper handling of malformed data or unexpectedly interrupted
sessions. In some languages, developers are responsible for tracking memory allocation and
releasing the memory. If there are no more pointers or references to the memory, then it can no
longer be tracked and identified for release.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 772 Missing Release of Resource after Effective Lifetime 1624
CanFollow 390 Detection of Error Condition Without Action 943
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
CWE Version 4.14
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-401: Missing Release of Memory after Effective Lifetime