Excessive Index Range Scan for a Data Resource

Incomplete Base
Structure: Simple
Description

This weakness occurs when a database query performs an index range scan that can access an unnecessarily large number of rows from a substantial data table, leading to severe performance degradation.

Extended Description

An excessive index range scan forces the database to examine far more rows than necessary to fulfill a query. While definitions of a 'large table' or 'excessive range' vary by context, the CISQ standard suggests a threshold of 1,000,000 table rows and an index range spanning more than 10 entries as indicators of this problem. This inefficient data access pattern consumes excessive CPU, memory, and I/O resources, directly slowing down application response times and scalability. If an attacker can trigger this inefficient query, the performance impact can be exploited in a denial-of-service (DoS) attack by overwhelming database resources. Although not a direct data breach, this slowdown can introduce a vulnerability by making critical services unavailable. Developers should audit queries on large tables to ensure index ranges are tightly constrained and that pagination or more selective filters are used to limit scanned rows.

Common Consequences 1
Scope: Other

Impact: Reduce Performance

References 1
Automated Source Code Performance Efficiency Measure (ASCPEM)
Object Management Group (OMG)
01-2016
ID: REF-959
Taxonomy Mapping
  • OMG ASCPEM