CWE-1235 describes code that uses boxed primitives in performance critical operations, which may introduce inefficiencies. MITRE lists Java and C# as the affected languages. It is mostly a quality weakness, and the security angle is availability.
It matters to teams that process large volumes of numeric data, or that handle input whose size an outsider can influence.
How it happens
Languages such as Java and C# have primitive types like int and reference types that wrap them, like Integer. Autoboxing converts a primitive into its wrapper automatically, and unboxing converts it back. The conversion is invisible in the source, so it is easy to write code that does it millions of times.
Generic collections are the usual trigger, because they hold objects and not primitives. A loop that sums values through a List<Integer> allocates and converts constantly.
// Inefficient pattern: boxing on every iteration
Long total = 0L; // boxed accumulator
for (int i = 0; i < values.length; i++) {
total += values[i]; // unbox, add, box again
}
// Better: stay with primitives in the hot path
long total = 0L;
for (int i = 0; i < values.length; i++) {
total += values[i];
}
The first version creates a new wrapper object on most iterations. The second creates none.
What an attacker gains
MITRE rates the likelihood low. The effect is reduced performance, which sometimes leads to resource consumption issues affecting availability when used with generic collections. The record lists CPU, memory and other resource consumption. An attacker who controls how much data flows through such code can turn slowness into denial of service, much as described in CWE-1176.
How to find it
MITRE lists automated static analysis (SAST) as a detection method. Static analysis can model data and control flow and flag patterns such as boxed types used in loops.
Other checks:
- Search for boxed types (
Integer,Long,Double) used as loop accumulators or counters. - Review collections of boxed numbers in code that handles large inputs.
- Profile allocation rate and garbage collection time under realistic load. Heavy short lived allocation points to boxing.
How to fix it
MITRE's mitigation is an implementation guideline.
- Limit boxed primitives to situations such as calling methods with typed parameters. They are suited to bridging the "impedance mismatch" between reference types and primitives.
- Do not use them for scientific computing or other performance critical operations.
- Examine the use of boxed primitives before adopting them.
- Use SparseArrays or ArrayMap instead of HashMap to avoid the performance overhead.
Keep in mind that most boxing is harmless. Fix the hot paths that profiling or review identifies, and leave the rest.
Quick check
What is autoboxing?
The automatic conversion of a primitive value into its wrapper object. Unboxing is the reverse. Both cost time and memory when repeated heavily.
Why is this tied to availability?
Excess CPU and memory use from boxing, particularly with generic collections, can degrade performance enough to affect availability.
Which languages does MITRE list?
Java and C#.
