| CCC.LB.TH01 | Unrestricted Request Traffic Overwhelms Downstream Services | Absence of filtering or rate limiting permits traffic to overload downstream services and facilitates brute-force activity. | 1 | 2 | 1 |
| CCC.LB.TH03 | Traffic Distribution Is Manipulated | Adjusting distribution policies can concentrate traffic on specific nodes causing DoS or redirect flows through unwanted paths. | 1 | 1 | 1 |
| CCC.LB.TH04 | Session Persistence Is Exploited | Improper session-affinity settings can enable session fixation or hijacking across backend targets. | 1 | 1 | 1 |
| CCC.LB.TH05 | Health Checks Are Exploited to Take Services Offline | Manipulating health-check endpoints or responses can cause healthy targets to be marked unavailable, leading to denial of service. | 1 | 1 | 1 |
| CCC.LB.TH06 | Sensitive Metadata Is Exposed via HTTP Headers | Response headers may reveal software versions, internal IPs, or other metadata useful for reconnaissance. | 1 | 1 | 1 |
| CCC.LB.TH07 | TLS Certificates Are Expired or Invalid | Stale or untrusted certificates weaken encrypted-traffic protection. | 1 | 1 | 1 |
| CCC.LB.TH08 | Weak TLS Policy Permits Protocol Downgrade | The TLS policy on a listener may be configured to accept deprecated protocol versions or weak cipher suites. Clients can then be forced into a downgraded handshake and the session decrypted or modified by an entity on the transmission path, compromising the confidentiality and integrity of the data in transit. | 0 | 1 | 1 |
| CCC.LB.TH09 | Traffic to Backend Targets Is Forwarded Unencrypted | When TLS is terminated at the load balancer and backend re-encryption is not configured, requests are forwarded to targets in cleartext. Any entity with access to the internal network path between the load balancer and the targets can read or alter the traffic, compromising the confidentiality and integrity of the data. | 0 | 1 | 1 |
| CCC.LB.TH10 | Client Certificate Validation Is Bypassed | Mutual TLS may be configured in passthrough mode, with a trust store that contains untrusted certificate authorities, or without revocation checking. Clients that present no certificate or a revoked one are then forwarded to backend targets as if authenticated, compromising the confidentiality and integrity of the resources behind the load balancer. | 0 | 1 | 1 |
| CCC.LB.TH11 | Routing Rules Direct Requests to Unintended Destinations | Path, host or header routing rules, redirects, rewrites and fixed responses may be misordered, overly broad, or modified without authorization. Requests are then forwarded to the wrong backend, redirected to an external destination, or answered with attacker-controlled content. This exposes internal services and compromises the confidentiality and integrity of user sessions and data. | 0 | 1 | 1 |
| CCC.LB.TH12 | Application-Layer Inspection Is Absent or Bypassed | The web application firewall may not be attached to the listener, may run in detection-only mode, or may be bypassed by traffic that is passed at layer 4 or carried over an upgraded WebSocket connection. Malformed or exploit payloads then reach backend targets without inspection, compromising the integrity and availability of those targets. | 0 | 1 | 1 |
| CCC.LB.TH13 | Client Source Address Is Spoofed via Forwarded Headers | Forwarded-for headers supplied by the client may be appended to rather than replaced by the load balancer. Backend targets and downstream access rules that trust these headers then attribute requests to a false source address, allowing IP-based allowlists to be bypassed and access logs to be poisoned. This compromises the confidentiality of protected resources and the integrity of audit records. | 0 | 1 | 1 |
| CCC.LB.TH14 | IPv6 Frontend Bypasses IPv4-Only Access Rules | A dual-stack frontend exposes the same backend targets over IPv6 while network access rules, firewall policies, or allowlists may be defined for IPv4 addresses only. Requests arriving over IPv6 are then accepted without the intended restrictions, compromising the confidentiality and integrity of the resources behind the load balancer. | 0 | 2 | 1 |