CWE-410

Insufficient Resource Pool

Medium

Description

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Potential Impact

How to Fix

Architecture and Design

Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.

Architecture and Design

Consider implementing a velocity check mechanism which would detect abusive behavior.

Operation

Consider load balancing as an option to handle heavy loads.

Implementation

Make sure that resource handles are properly closed when no longer needed.

Architecture and Design

Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-410 vulnerabilities in your codebase.

Get Security Assessment