CWE-419 Uncontrolled Resource Consumption

Coverage: 3 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 2Other-pattern 1 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged code paths where an attacker can cause the system to consume too much CPU, memory, disk, or network, often by sending large inputs, triggering expensive operations, or creating unbounded loops/queues.

Why it matters

Unbounded resource use can lead to outages or denial of service.

• Denial of service: repeated expensive requests degrade or crash services.
• Cost spikes: runaway compute/storage bills (especially in cloud environments).
• Cascading failures: one overloaded service can take down dependent services.

Safer examples

1) Put hard limits on inputs and work

Limit request body size, file upload size, query complexity, pagination, and recursion depth.

2) Add timeouts and circuit breakers

Set DB/query timeouts, HTTP timeouts, and background job time limits.

3) Rate limit expensive endpoints

Apply throttling and caching to expensive operations; prefer async processing for heavy tasks.

How SiteShadow detects it (high level)

• Detects high-cost operations reachable from request input without guards (limits, timeouts, pagination).
• Flags unbounded loops, queues, and missing size checks near parsers and upload handlers.

References

• CWE-419: https://cwe.mitre.org/data/definitions/419.html

---

← Back to Vulnerability Library