Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.
CWE-407 Class Incomplete
Inefficient Algorithmic Complexity
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm…
Definition
What is CWE-407?
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm into its slowest possible execution path, leading to severe performance degradation or denial of service.
At its core, this issue is about predictable resource exhaustion. Common examples include using algorithms with quadratic (O(n²)) or exponential complexity for tasks that handle user-controlled data size, like inefficient sorting or search algorithms on large, attacker-supplied inputs. When exploited, this can cause excessive CPU consumption, memory usage, or runtime delays, crippling the application's availability.
Developers can mitigate this by selecting algorithms with consistent, efficient complexity (like O(n log n) for sorting) and implementing safeguards. These include setting hard limits on input size, using timeouts for operations, and switching to more performant algorithms or data structures when processing thresholds are crossed. Always profile code with worst-case input scenarios during testing.
Auswirkungen in der Praxis
Real-world CVEs caused by CWE-407
-
C++ library for image metadata has "quadratic complexity" issue with unnecessarily repetitive parsing each time an invalid character is encountered
-
Python has "quadratic complexity" issue when converting string to int with many digits in unexpected bases
-
server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
-
Perl-based email address parser has "quadratic complexity" issue via a string that does not contain a valid address
-
CPU consumption via inputs that cause many hash table collisions.
-
CPU consumption via inputs that cause many hash table collisions.
-
Product performs unnecessary processing before dropping an invalid packet.
-
CPU and memory consumption using many wildcards.
Wie Angreifer es ausnutzen
Angreiferpfad Schritt für Schritt
- 1
This example attempts to check if an input string is a "sentence" [REF-1164].
- 2
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
- 3
Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx.
Verwundbares Codebeispiel
Vulnerable JavaScript
This example attempts to check if an input string is a "sentence" [REF-1164].
var test_string = "Bad characters: $@#";
var bad_pattern = /^(\w+\s?)*$/i;
var result = test_string.search(bad_pattern); Sicheres Codebeispiel
Secure JavaScript
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
var test_string = "Bad characters: $@#";
var good_pattern = /^((?=(\w+))\2\s?)*$/i;
var result = test_string.search(good_pattern); What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste
How to prevent CWE-407
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Erkennungssignale
How to detect CWE-407
Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.
Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.
Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.
Plexicus erkennt CWE-407 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.
Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.
Häufig gestellte Fragen Was ist CWE-407?
Wie gravierend ist CWE-407?
Welche Sprachen oder Plattformen sind von CWE-407 betroffen?
Wie kann ich CWE-407 verhindern?
Wie erkennt und behebt Plexicus CWE-407?
Wo erfahre ich mehr über CWE-407?
Frequently asked questions
Was ist CWE-407?
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm into its slowest possible execution path, leading to severe performance degradation or denial of service.
Wie gravierend ist CWE-407?
MITRE stuft die Exploit-Wahrscheinlichkeit als niedrig ein — eine Ausnutzung ist selten, die Schwachstelle sollte aber dennoch behoben werden, sobald sie entdeckt wird.
Welche Sprachen oder Plattformen sind von CWE-407 betroffen?
MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.
Wie kann ich CWE-407 verhindern?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
Wie erkennt und behebt Plexicus CWE-407?
Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-407 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.
Wo erfahre ich mehr über CWE-407?
MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/407.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.
Verwandte Schwachstellen
Weaknesses related to CWE-407
CWE-405 Parent
Asymmetric Resource Consumption (Amplification)
This vulnerability occurs when a system allows an attacker to trigger a disproportionate amount of resource consumption—like CPU, memory,…
CWE-1050 Sibling
Excessive Platform Resource Consumption within a Loop
This vulnerability occurs when a loop contains code that repeatedly consumes critical system resources like file handles, database…
CWE-1072 Sibling
Data Resource Access without Use of Connection Pooling
This weakness occurs when an application creates a new database connection for every request instead of using a managed connection pool.…
CWE-1073 Sibling
Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
This weakness occurs when a client-side function or method makes an excessive number of individual data requests through a non-SQL data…
CWE-1084 Sibling
Invokable Control Element with Excessive File or Data Access Operations
This weakness occurs when a single function or method performs an excessive number of file or database operations, such as repeated reads,…
CWE-1089 Sibling
Large Data Table with Excessive Number of Indices
This weakness occurs when an application uses a database table with a very large number of rows and creates too many indexes on it,…
CWE-1094 Sibling
Excessive Index Range Scan for a Data Resource
This weakness occurs when a database query performs an index range scan that can access an unnecessarily large number of rows from a…
CWE-1176 Sibling
Inefficient CPU Computation
This weakness occurs when software uses inefficient algorithms or suboptimal CPU operations, performing unnecessary or overly complex…
CWE-406 Sibling
Insufficient Control of Network Message Volume (Network Amplification)
This vulnerability occurs when a system fails to properly limit the amount of network traffic it can generate in response to a request,…
Bereit, wenn du es bist
Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.
Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.