VNX-1050: Excessive Platform Resource Consumption within a Loop

Reports Python code that opens a database connection, pool, engine, HTTP session, cloud SDK client, broker or SMTP/FTP connection on every loop iteration with arguments that do not depend on the iteration. Per-target connections, retry loops, hoisted resources, open() and tests are not reported.

Field	Value
Rule ID	`VNX-1050`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1050
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`excessive-platform-resource-in-loop` `performance` `resource-management` `cwe-1050`
Source	`internal/sast/rules/vnx-1050.rego`

Overview

VNX-1050 maps to CWE-1050: Excessive Platform Resource Consumption within a Loop. It reports a Python for or while loop whose body creates a new connection, pool, engine, session or client although nothing passed to the constructor depends on the iteration, so the resource could be created once before the loop.

Constructors recognised: connect() of sqlite3, psycopg2, psycopg, pymysql, MySQLdb, mysql.connector, pymssql, pyodbc, cx_Oracle, oracledb, asyncpg and aiomysql; create_pool(); create_engine/create_async_engine; MongoClient; redis.Redis/StrictRedis/from_url; requests.Session; httpx.Client/AsyncClient; aiohttp.ClientSession; urllib3.PoolManager; boto3.client/resource/Session; pika.BlockingConnection; smtplib.SMTP/SMTP_SSL; ftplib.FTP.

Why This Matters

Each connection costs a TCP and often a TLS handshake, an authentication round trip and server-side memory. Opening one per item turns a batch job into a connection storm that exhausts database connection limits, ephemeral ports and file descriptors.

Not reported: a constructor whose arguments use the loop variable or a name assigned inside the loop (a connection per host, shard or URI), retry and polling loops (the body breaks or sleeps, or the header names a retry or attempt counter), a resource created before the loop, open() of a file per iteration, comments, string literals and test files.

What Gets Flagged

for cid in customer_ids:
    conn = pymysql.connect(
        host=config.DB_HOST,
        user=config.DB_USER,
        database="sales",
    )

for event in events:
    session = requests.Session()
    session.post(WEBHOOK, json=event.to_dict(), timeout=10)

Not flagged:

for host in hosts:
    conn = psycopg2.connect(host=host, dbname="metrics")

Remediation

Create the connection, session or client once before the loop and reuse it.
Use a connection pool when work is spread across threads or tasks.
Close the resource after the loop, for example with a with block around it.

References

CWE-1050: Excessive Platform Resource Consumption within a Loop

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1050
// nosec vnx-1050

Or record an ignore rule: vulnetix ignore add --rule vnx-1050 --reason "...". See Suppressing findings.