CME-917

Worker Process Recycling (MaxConnectionsPerChild / max_requests)

Harden Application Unquantified evidence Preventive

Description

Configures application servers to periodically recycle worker processes after handling a fixed number of requests, bounding the cumulative impact of per-request memory leaks. When a worker reaches its request limit, it is gracefully terminated and replaced with a fresh process, releasing all leaked memory. Applicable to Apache HTTP Server (MaxConnectionsPerChild), PHP-FPM (pm.max_requests), Gunicorn (--max-requests with --max-requests-jitter for staggered recycling), Puma (worker_timeout), and Unicorn (after_fork with request counting). The recycling threshold should be set low enough to prevent OOM conditions but high enough to avoid excessive process churn — typical values range from 500 to 10000 requests per worker depending on application memory profile.

CVSS Vector Impacts

Metric	Transition	Rationale
Availability (A)	H → L	Per-request memory leaks are bounded by the worker lifecycle; each worker is recycled after a fixed number of requests, releasing accumulated leaked memory before it can cause resource exhaustion. The application experiences brief per-worker restart latency rather than system-wide memory starvation.

CWE Relationships

CWE-772 CWE-401

Verification

Check that application server worker recycling is configured with a finite request limit

$ grep -i MaxConnectionsPerChild /etc/httpd/conf/*.conf /etc/httpd/conf.d/*.conf 2>/dev/null
# Expected: Non-empty output with a positive integer (not 0, which disables recycling)

Platform: rhel

$ grep pm.max_requests /etc/php-fpm.d/*.conf /etc/php/*/fpm/pool.d/*.conf 2>/dev/null
# Expected: Non-empty output with a positive integer (not 0, which disables recycling)

Platform: linux

$ ps aux | grep '[g]unicorn' | grep -oE '\-\-max-requests[= ][0-9]+'
# Expected: Non-empty output — --max-requests flag present on running Gunicorn workers

Platform: linux

Remediation

linux Apache httpd worker recycling via MaxConnectionsPerChild


printf '# CME-917: Worker process recycling to bound memory leak impact\nMaxConnectionsPerChild 1000\n' > /etc/httpd/conf.d/cme-917-worker-recycling.conf
apachectl configtest
systemctl reload httpd

linux PHP-FPM worker recycling via pm.max_requests


sed -i 's/^;\?pm\.max_requests\s*=.*/pm.max_requests = 500/' /etc/php-fpm.d/www.conf 2>/dev/null || sed -i 's/^;\?pm\.max_requests\s*=.*/pm.max_requests = 500/' /etc/php/*/fpm/pool.d/www.conf
systemctl restart php-fpm

linux Gunicorn worker recycling via --max-requests with jitter


mkdir -p /etc/systemd/system/<service>.service.d && printf '[Service]\nEnvironment="GUNICORN_CMD_ARGS=--max-requests 1000 --max-requests-jitter 50"\n' > /etc/systemd/system/<service>.service.d/cme-917-worker-recycling.conf
systemctl daemon-reload && systemctl restart <service>