Runtime Resource Management Control Element in a Component Built to Run on Application Servers

Incomplete Base
Structure: Simple
Description

This weakness occurs when an application built to run on a managed application server bypasses the server's high-level APIs and instead uses low-level operating system calls to directly control resources like memory, files, or threads.

Extended Description

Application servers (like Tomcat, WebSphere, or Spring) provide managed environments with built-in resource handling for scalability and stability. When developers circumvent these controls, they introduce unpredictable behavior—such as memory leaks, file lock conflicts, or thread exhaustion—that can cause crashes, performance degradation, and instability under load. This undermines the primary reliability benefits of using an application server in the first place. From a security perspective, while not a direct vulnerability, this unreliable behavior creates a weak foundation that attackers can exploit. An attacker might trigger resource exhaustion to cause a denial-of-service, or leverage a crash to reveal sensitive information in error logs. Ensuring your application consistently uses the server's sanctioned APIs for resource management is crucial for both robustness and long-term security.

Common Consequences 1
Scope: Other

Impact: Reduce Reliability

References 1
Automated Source Code Reliability Measure (ASCRM)
Object Management Group (OMG)
01-2016
ID: REF-961
Taxonomy Mapping
  • OMG ASCRM