Insufficient Resource Pool
CWE-410
The product's resource pool is not large enough to handle peak demand.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
How this weakness is prevented
- Architecture and Design: Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
- Architecture and Design: Consider implementing a velocity check mechanism which would detect abusive behavior.
- Operation: Consider load balancing as an option to handle heavy loads.
- Implementation: Make sure that resource handles are properly closed when no longer needed.
- Architecture and Design: Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
Latest Insufficient Resource Pool vulnerabilities
- 7.5 High severity
IE-SW-VL05M-5TX: Insufficient Resource Pool
An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.
- 7.5 High severity
Wyse Management Suite: Insufficient Resource Pool
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- 7.5 High severity
mlflow/mlflow: Insufficient Resource Pool
In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow,
- 7.5 High severity
DietPi-Dashboard: Improper Locking
DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshak
- 7.5 High severity
SDS-3008 Series Industrial Ethernet Switch: Insufficient Resource Pool
A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP message header can lead to denial of service. An attacker can send an HTTP request to trigger this vulnera
- 7.5 High severity
PowerScale OneFS: Insufficient Resource Pool
Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
- 7.5 High severity
Eclipse Jetty: Insufficient Resource Pool
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario wh