CWEweakness
CWE-410 Insufficient Resource Pool
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific, Python
- CWE version
- 5.0
Description
The product's resource pool is not large enough to handle peak demand.
Common consequences
• Availability, Integrity, Other: DoS: Crash, Exit, or Restart, Other — An attacker can prevent others from accessing the resource by using a (relatively) large number of requests for resources using a "flood" of connection or sessions.
Potential mitigations
• [Architecture and Design] Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
• [Architecture and Design] Consider implementing a velocity check mechanism which would detect abusive behavior.
• [Operation] Consider load balancing as an option to handle heavy loads.
• [Implementation] Make sure that resource handles are properly closed when no longer needed.
• [Architecture and Design] Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
Observed examples
• CVE-1999-1363: Large number of locks on file exhausts the pool and causes crash.
• CVE-2001-1340: Product supports only one connection and does not disconnect a user who does not provide credentials.
• CVE-2002-0406: Large number of connections without providing credentials allows connection exhaustion.
Related
Observed example · CVE (3)
- CVE-2002-0406 Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to… vulnerability
- CVE-2001-1340 Beck GmbH IPC@Chip TelnetD service supports only one connection and does not disconnect a user who does not complete the login process,… vulnerability
- CVE-1999-1363 Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on… vulnerability
Can precede · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
Child of · CWE (1)
- CWE-664 Improper Control of a Resource Through its Lifetime weakness
Referenced by CVE · weakness (22)
- CVE-2026-114472 Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote… vulnerability
- CVE-2026-58218 A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before… vulnerability
- CVE-2026-34019 When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the… vulnerability
- CVE-2025-2134 IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries… vulnerability
- CVE-2025-12986 When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a… vulnerability
- CVE-2025-41653 An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a… vulnerability
- CVE-2025-20103 Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially… vulnerability
- CVE-2025-27479 Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network. vulnerability
- CVE-2025-27694 Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. vulnerability
- CVE-2025-0453 In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. vulnerability
- CVE-2024-7392 ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service Vulnerability. vulnerability
- CVE-2023-7033 Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L… vulnerability
- CVE-2023-38505 DietPi-Dashboard is a web dashboard for the operating system DietPi. vulnerability
- CVE-2022-40224 A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. vulnerability
- CVE-2022-46679 Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. vulnerability
- CVE-2022-20937 A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated,… vulnerability
- CVE-2022-2048 In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up… vulnerability
- CVE-2022-22191 A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300… vulnerability
- CVE-2021-1615 A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller (EWC) Software for Catalyst Access Points… vulnerability
- CVE-2019-13921 A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). vulnerability
- CVE-2019-0056 This issue only affects devices with three (3) or more MPC10's installed in a single chassis with OSPF enabled and configured on the device. vulnerability
- CVE-2018-13815 A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). vulnerability
Referenced by CWE · can also be (1)
- CWE-412 Unrestricted Externally Accessible Lock weakness