CWE-410: Insufficient Resource Pool
Description
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Frequently the consequence is a flood of connection or sessions.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- AvailabilityIntegrityOther
DoS: Crash, Exit, or Restart; Other
Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.
Potential mitigations
- Architecture and Design
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
- Architecture and Design
Consider implementing a velocity check mechanism which would detect abusive behavior.
- Operation
Consider load balancing as an option to handle heavy loads.
- Implementation
Make sure that resource handles are properly closed when no longer needed.
- Architecture and Design
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
Related weaknesses
Parent weaknesses
Can lead to
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.