Excessive Platform Resource Consumption within a Loop

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when a loop contains code that repeatedly consumes critical system resources like file handles, database connections, memory, or session locks. Each iteration of the loop drains these finite platform assets without proper release.

Extended Description

At its core, this is a resource management flaw within an iterative process. The loop body or its exit condition performs operations—such as opening files, creating network connections, or acquiring synchronization locks—that allocate platform-level resources. If these resources are not explicitly freed or closed within the same iteration, they accumulate with each pass. This quickly exhausts available pools, leading to severe performance degradation, application instability, or complete failure when the system runs out of descriptors, memory, or other critical assets. While this often manifests as a performance bug, it becomes a security vulnerability when an attacker can control the loop's iteration count. By forcing an excessive number of cycles—for example, by submitting specially crafted input—they can trigger sustained resource exhaustion. This creates a reliable denial-of-service (DoS) condition, rendering the application or even the host platform unresponsive as it starves other processes of necessary resources.

Common Consequences 1
Scope: Other

Impact: Reduce Performance

References 1
Automated Source Code Performance Efficiency Measure (ASCPEM)
Object Management Group (OMG)
01-2016
ID: REF-959
Taxonomy Mapping
  • OMG ASCPEM