vetkit.resilience.http-call-without-timeout.java-resttemplate
new RestTemplate() uses the JDK's default HttpURLConnection settings, which have no connect or read timeout, so a slow or unresponsive upstream blocks the calling thread (and the request it serves) indefinitely.
Last updated:
Suite: Production readiness
java
new RestTemplate() uses the JDK's default HttpURLConnection settings, which have no connect or read timeout, so a slow or unresponsive upstream blocks the calling thread (and the request it serves) indefinitely.
Category: RESILIENCE · Engine rule severity: WARNING
How to fix it
Build the client with Spring Boot's RestTemplateBuilder and set the connect and read timeouts, or pass a request factory configured with them (SimpleClientHttpRequestFactory#setConnectTimeout / setReadTimeout), and share one instance as a bean instead of creating it per call.
References
Source: packages/engine/rules/resilience/java.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.