CWE-410: Insufficient Resource Pool
Class
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Frequently the consequence is a "flood" of connection or sessions.
Consequences
- Availability, Integrity, Other: DoS: Crash, Exit, or Restart, Other
How to prevent it
- Architecture and Design: Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
- Architecture and Design: Consider implementing a velocity check mechanism which would detect abusive behavior.
- Operation: Consider load balancing as an option to handle heavy loads.
- Implementation: Make sure that resource handles are properly closed when no longer needed.
- Architecture and Design: Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
Recent advisories
- GHSA-49m6-vrr9-2cqm — MLflow Uncontrolled Resource Consumption vulnerability
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor