CWE-1065 applies when a product uses deployed components from application servers but also uses low-level functions or methods to manage resources, instead of the API the application server provides. Think of Java enterprise components that start their own threads or open raw sockets inside a managed container.
How it happens
The container manages threads, connections and lifecycle for you. A developer bypasses it for a quick fix.
// Pattern to avoid: unmanaged thread inside a container component
new Thread(() -> doWork()).start();
// Better: use the executor the server provides
@Resource
ManagedExecutorService executor;
executor.submit(() -> doWork());
The container cannot track, limit or clean up the first thread.
What an attacker gains
MITRE lists reduced reliability. If an attacker can reach the code, the issue "might introduce a vulnerability."
How to find it
The record lists no detection methods. Search managed components for thread creation, raw socket opens and file handles that the server API would normally supply.
How to fix it
Use the resource management API the application server offers, and let the container own lifecycle and limits.
Quick check
Why prefer the server's API?
The server can then track, limit and clean up resources. Low-level calls hide them from it.
