CWE-410 상세 정보

The product's resource pool is not large enough to handle peak demand.

취약점 도입 방식

Architecture and Design
Implementation
Operation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)
이름: Python (Undetermined)

일반적인 결과

관찰된 예시

잠재적 완화 방법

Phases : Architecture and Design
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Phases : Architecture and Design
Consider implementing a velocity check mechanism which would detect abusive behavior.
Phases : Operation
Consider load balancing as an option to handle heavy loads.
Phases : Implementation
Make sure that resource handles are properly closed when no longer needed.
Phases : Architecture and Design
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Flooding attacks often cause a crash or other problem besides denial of the resource itself; these are likely examples of other weaknesses, not an insufficient resource pool.

참고 자료

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-1541

Secure Coding Guide for Python
OpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/

제출

수정 사항