ASVS 5.0 V15.4.4 requires resource allocation policies that prevent thread starvation, giving fair access through thread pools so lower priority work can proceed in reasonable time. It is Level 3. Use bounded, separate pools per workload class and fair queues instead of one shared pool anyone can fill.
Why it matters
If a single pool serves every task, one slow or abusive workload can occupy all threads. Login, health checks and payments then wait behind report exports. To an attacker, starving the pool is a cheap denial of service.
How to implement it
Give critical and bulk work separate pools with bounded queues:
ExecutorService critical = new ThreadPoolExecutor(
8, 8, 0, TimeUnit.SECONDS, new ArrayBlockingQueue<>(100),
new ThreadPoolExecutor.AbortPolicy());
ExecutorService bulk = new ThreadPoolExecutor(
4, 4, 0, TimeUnit.SECONDS, new ArrayBlockingQueue<>(500),
new ThreadPoolExecutor.CallerRunsPolicy());
ReentrantLock fairLock = new ReentrantLock(true); // fair ordering where contention matters
Bound the queue so overload becomes a visible rejection rather than unbounded memory growth.
How to test it
Saturate the bulk pool with long tasks, then measure latency of critical requests. They should stay within target. Also confirm rejected work returns a clear error.
Common mistakes
- Unbounded queues that hide overload until memory runs out.
- One global pool for every task type.
- Priority schemes that let low priority work wait forever.
Quick check
Do more threads fix starvation?
Rarely. Separation and bounds fix it. A bigger shared pool only delays the same problem.
