Creation of Class Instance within a Static Code Block

Incomplete Base
Structure: Simple
Description

This weakness occurs when a class instance is created inside a static initializer block, causing premature and potentially expensive object creation.

Extended Description

This pattern flags when a static code block—which executes when a class is first loaded—creates an object or performs complex initialization. This forces the program to allocate resources and run constructors earlier than necessary, which can delay application startup and increase memory usage regardless of whether the object is ever actually used. From a security perspective, if an attacker can trigger the loading of this class, they can exploit this forced initialization to cause performance degradation or resource exhaustion, potentially leading to a denial-of-service (DoS) condition. Developers should refactor this to use lazy initialization, creating the instance only when it's first needed within a method.

Common Consequences 1
Scope: Other

Impact: Reduce Performance

References 1
Automated Source Code Performance Efficiency Measure (ASCPEM)
Object Management Group (OMG)
01-2016
ID: REF-959
Related Weaknesses
Taxonomy Mapping
  • OMG ASCPEM