Tested fixes for CWE-400 in Express, ASP.NET Core, FastAPI and net/http: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-400: The product does not properly control the allocation and maintenance of a limited resource.
Common consequences MITRE lists
- Availability: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
- Access Control, Other: Bypass Protection Mechanism; Other
Exhaustion takes the service down for everyone or produces an unexpected bill. MITRE discourages mapping findings to this broad entry; prefer a specific child such as CWE-770.
- Bound every resource a request can use: input size, work per request, concurrency, queue length and time.
- Apply quotas per user and tenant, and degrade gracefully when they are reached.
- Monitor resource use and alert before limits are hit.
Guides on this site
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Apply security limits to GraphQL, WebSocket and gRPC operations
Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Parse bounded JSON and XML into an explicit application schema
Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Keep HTTP services up under application-layer DDoS
Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
Practice
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Repair a real proxy and shared cache · Local project
- Parse bounded JSON and XML invoices safely · Local project
- Convert untrusted documents in a locked-down container · Local project
References
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.