CWE-239 is a failure to properly handle an element that is not completely specified. In practice the most common victim is a network service that waits for the rest of a message that never comes.
How it happens
A server reads a request until it sees an end marker. A client sends part of a request and stops, keeping the connection open. If the server has no timeout and holds a thread or buffer for each such client, a few of these connections can crowd out real users.
MITRE records several observed cases:
- CVE-2002-1532: an HTTP GET without the closing CRLF sequences made the product wait indefinitely and blocked other users.
- CVE-2003-0195: a partial request was not timed out.
- CVE-2005-2526: CPU exhaustion in a printer from a partial printing request followed by early termination of the connection.
- CVE-2002-1906: CPU consumption from incomplete HTTP requests with connections left open.
What an attacker gains
The consequences are listed as integrity, unexpected state and "varies by context". The examples above are availability attacks: the service stays up but stops answering others.
How to find it
The record lists no detection methods. Try this:
- Open a socket, send half a request, and see how long the server holds it.
- Open many such sockets and watch resource use.
- Check that your reverse proxy sets header and body read timeouts.
How to fix it
The record lists no mitigations, so these come from the examples.
- Set read timeouts for headers and bodies.
- Limit concurrent connections per client.
- Free buffers when a connection drops mid message.
- Put a front end in place that buffers slow clients so application threads are not tied up.
Quick check
Why is a partial request dangerous?
The server may hold resources while it waits. With no timeout, a small number of idle connections can block legitimate users.
