CWEweakness
CWE-1088 Synchronous Access of Remote Resource without Timeout
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
Common consequences
• Other: Reduce Reliability — This issue can prevent the product from running reliably, since an outage for the remote resource can cause the product to hang. If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2024-8062: API endpoint performs a HEAD request without a timeout, allowing attackers to cause the server to hang
• CVE-2024-8061: development product for AI can make requests to external servers without timeouts and does not respond to other requests while waiting, allowing DoS
Related
Observed example · CVE (2)
- CVE-2024-8061 In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to… vulnerability
- CVE-2024-8062 A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. vulnerability
Child of · CWE (1)
- CWE-821 Incorrect Synchronization weakness
Referenced by CVE · weakness (8)
- CVE-2026-103649 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server… vulnerability
- CVE-2026-89147 Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated… vulnerability
- CVE-2026-81520 A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by… vulnerability
- CVE-2025-4656 Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by… vulnerability
- CVE-2024-12777 A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. vulnerability
- CVE-2024-8061 In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to… vulnerability
- CVE-2024-8062 A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. vulnerability
- CVE-2020-14483 A timeout during a TLS handshake can result in the connection failing to terminate. vulnerability