# Cwe 400 Resource Exhaustion

> Use this skill when you need to remediate CWE-400 (Uncontrolled Resource Consumption) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing uncontrolled resource consumption issues.

- Skill: `developerscoffee/cwe-400-resource-exhaustion` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-400-resource-exhaustion`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-400-resource-exhaustion/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-400-resource-exhaustion

---


# CWE-400 Uncontrolled Resource Consumption

## Description

Uncontrolled Resource Consumption

Reference:
https://cwe.mitre.org/data/definitions/400.html


**OWASP Category**: A04:2021 – Insecure Design


---

## Vulnerable Pattern


### ❌ Example 1: Vulnerable Pattern

```java
// VULNERABLE: No size limit on upload
@PostMapping("/upload")
public void upload(@RequestParam MultipartFile file) {
    byte[] content = file.getBytes();  // Can exhaust memory
    saveFile(content);
}

// VULNERABLE: Unbounded list growth
List<String> items = new ArrayList<>();
while (scanner.hasNext()) {
    items.add(scanner.next());  // No limit
}
```


**Why it's vulnerable:** This pattern is vulnerable to Uncontrolled Resource Consumption




---

## Deterministic Fix


### ✅ Secure Implementation: Secure Implementation

```java
// SECURE: Enforce limits
private static final long MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
private static final int MAX_ITEMS = 10000;

@PostMapping("/upload")
public void upload(@RequestParam MultipartFile file) {
    if (file.getSize() > MAX_FILE_SIZE) {
        throw new IllegalArgumentException("File too large");
    }
    // Stream to disk instead of memory
    file.transferTo(new File(uploadPath));
}

// With bounded collection
List<String> items = new ArrayList<>();
int count = 0;
while (scanner.hasNext() && count < MAX_ITEMS) {
    items.add(scanner.next());
    count++;
}
```


**Why it's secure:** Implements proper protection against Uncontrolled Resource Consumption




---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find unbounded file operations
grep -rn "file.getBytes()\|IOUtils.toByteArray" --include="*.java"
```



---

## Remediation Steps


1. Set maximum limits for uploads, collections, iterations

2. Stream large data instead of loading into memory

3. Configure timeouts for all external operations

4. Use connection pools with max size


---

## Key Imports

```java

```

---

## Verification

After remediation:


- Run SAST scanner to confirm vulnerability is resolved

- Review all instances of the vulnerable pattern

- Add unit tests that verify the secure implementation

- Check for similar patterns in related code


---

## Trigger Examples

```
Fix CWE-400 vulnerability
Resolve Uncontrolled Resource Consumption issue
Secure this Java code against uncontrolled resource consumption
SAST reports CWE-400
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Controller | `*Controller.java` | User input handling |

| Service | `*Service.java` | Business logic |

| Repository | `*Repository.java` | Data access |


---

## References


- [CWE-400: Resource Exhaustion](https://cwe.mitre.org/data/definitions/400.html)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07