CWE-410 applies when a resource pool is not large enough for peak demand, so an attacker can use a relatively large number of requests to prevent others from reaching the resource. MITRE notes the frequent result is a flood of connections or sessions.
How it happens
Servers keep finite pools: connection slots, sessions, file locks, worker threads. If anyone can claim a slot, and slots are not reclaimed quickly, one client can take them all.
MITRE's observed examples show the shapes this takes:
- A large number of locks on a file exhausted the pool and caused a crash (CVE-1999-1363).
- A product supported only one connection and did not disconnect a user who never supplied credentials (CVE-2001-1340).
- Many connections without credentials allowed connection exhaustion (CVE-2002-0406).
What an attacker gains
Denial of service. The record also warns that floods often cause a crash or another problem besides the denial of the resource itself, and those are likely other weaknesses, not this one.
How to find it
The record lists no detection methods. Try these:
- List every pool in your system and its size. Ask who can claim a slot and how long they can hold it.
- Open many idle, unauthenticated connections in a test environment and see whether legitimate users still get in.
- Look at timeouts. Missing ones are the usual root cause.
How to fix it
- Size pools for peak demand, with headroom.
- Add idle and handshake timeouts so unauthenticated connections are dropped fast.
- Cap connections per client address.
- Reserve capacity for authenticated or critical users.
- Alert when pool use approaches the limit.
Quick check
Is a bigger pool the whole fix?
No. A larger pool just raises the bar. Timeouts and per client limits stop a single actor from holding everything.
