VNX-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers

Java servlets, EJBs, JAX-RS resources and Spring controllers that call System.exit(), Runtime.getRuntime().exit()/halt() or create their own threads with new Thread(...) or an Executors pool; launcher main methods and tests are not reported.

Field	Value
Rule ID	`VNX-1065`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-1065
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`runtime-mgmt-in-app-server` `app-server` `java` `cwe-1065`
Source	`internal/sast/rules/vnx-1065.rego`

Overview

VNX-1065 maps to CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers. Java: a component that runs inside an application server or servlet container (a class extending HttpServlet/GenericServlet, an EJB annotated @Stateless/@Stateful/@Singleton/@MessageDriven, a @WebServlet/@WebFilter/@WebListener, a @ServerEndpoint WebSocket endpoint, a JAX-RS resource, or a Spring @Controller/@RestController, or a file importing javax/jakarta servlet, EJB, JAX-RS or WebSocket APIs) that manages the JVM or its threads itself: System.exit(), Runtime.getRuntime().exit()/halt() (also split across lines, or through a variable assigned Runtime.getRuntime()), new Thread(…), or an unmanaged java.util.concurrent.Executors.new…() pool. Exiting stops the whole server and every other application on it; unmanaged threads escape the container’s lifecycle, security context and thread-pool limits (use a ManagedExecutorService or the framework’s task executor). Not reported: the same calls in command-line programs and other classes with no container API, inside a static void main (a launcher that boots an embedded server), in test sources, Thread.currentThread() and other Thread static methods, ThreadLocal and Thread arrays, lookalike identifiers, and comments or string literals.

Why This Matters

This weakness class (Runtime Resource Management Control Element in a Component Built to Run on Application Servers) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1065 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

public class AdminServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
        System.exit(0);                         // FLAGGED: stops the whole server
    }
}

@Stateless
public class ReportBean {
    public void generate(String id) {
        new Thread(() -> render(id)).start();   // FLAGGED: unmanaged thread in an EJB
    }
}

Also flagged: Executors.newFixedThreadPool(4) in a @WebListener, and rt.halt(0) after Runtime rt = Runtime.getRuntime(); in a servlet.

Not flagged: System.exit in a command-line main (even one that starts an embedded Jetty), threads started in servlet tests, a ManagedExecutorService, Thread.currentThread(), and comments or strings.

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-1065 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-1065 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1065
// nosec vnx-1065

Or record an ignore rule: vulnetix ignore add --rule vnx-1065 --reason "...". See Suppressing findings.