Resource Allocation Without Limits
CWE-770: Allocation of Resources Without Limits or Throttling
This weakness occurs when software allocates memory, connections, threads, file handles, or other resources on request without any limit on how many or how much. An attacker can then exhaust the resource and deny service to everyone else, often with very little effort. It is common in parsers that trust size fields, APIs with no rate limiting, and protocol implementations that let a client open unlimited streams or sessions.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An API endpoint lets a client request page sizes of a million records, exhausting server memory with a single call.
- A server allocates a buffer based on a client-declared content length before receiving any data.
- An HTTP/2 implementation lets a client open and cancel streams endlessly, consuming server CPU (the Rapid Reset pattern).
How to mitigate it
- Set explicit limits on request size, page size, upload size, connections, and concurrent operations.
- Apply rate limiting and quotas per user, token, and IP address.
- Allocate resources incrementally as data actually arrives, and set timeouts on every connection and job.
- Load test with abusive inputs and monitor resource usage so exhaustion is detected and contained.
Go deeper
Practice this topic
Test your knowledge of Resource Allocation Without Limits with exam-style practice questions.