VNX-410: Insufficient Resource Pool

A shared server pool capped at one or two members by a literal: HikariCP setMaximumPoolSize, DBCP setMaxTotal/setMaxActive, Tomcat/Jetty setMaxThreads and QueuedThreadPool, Spring hikari maximum-pool-size, dbcp2 max-total and tomcat threads.max (any relaxed-binding spelling) in .properties or application.yml, and newFixedThreadPool/ThreadPoolExecutor of size 1-2 in request-serving code.

Field	Value
Rule ID	`VNX-410`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Any file
CWE	CWE-410
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`resource-pool` `cwe-410`
Source	`internal/sast/rules/vnx-410.rego`

Overview

VNX-410 maps to CWE-410: Insufficient Resource Pool. The rule reports a shared server resource pool (database connections, request threads, a request executor) capped at one or two members by a literal.

Why This Matters

When a pool has one or two members, a couple of slow or deliberately held requests take all of them, and every other client blocks until they are released. Whether a larger literal is enough for peak load cannot be judged statically, so only the degenerate sizes are reported.

What Gets Flagged

config.setMaximumPoolSize(1);                                    // FLAGGED (HikariCP)
ds.setMaxTotal( 2 );                                             // FLAGGED (DBCP)
QueuedThreadPool threads = new QueuedThreadPool(2);              // FLAGGED (Jetty)
private final ExecutorService pool = Executors.newFixedThreadPool(1);   // FLAGGED in a ServerSocket/servlet/controller file

spring.datasource.hikari.maximum-pool-size=1                     # FLAGGED
server.tomcat.threads.max = 2                                    # FLAGGED

Not flagged: sizes from variables or expressions, larger literals, newScheduledThreadPool(1) and newSingleThreadExecutor(), a one-thread executor in code that does not serve requests, test files, comments and strings.

Remediation

Size pools for peak concurrency, from configuration rather than a literal.
Set an acquisition timeout so a starved pool fails fast instead of queueing forever.
For confirmed false positives, add a // vulnetix-ignore: VNX-410 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-410
// nosec vnx-410

Or record an ignore rule: vulnetix ignore add --rule vnx-410 --reason "...". See Suppressing findings.