This error occurs when unvalidated user input is used as the index of an array or by methods that will use it as the index of an array.
When unvalidated user input is used as the index of an array or by methods that will use it as the index of an array, an attack can cause the methods to throw an ArrayOutOfBounds exception. This can then be used to cause Denial of Service or to manipulate the stated object to create an alternate control flow, which could be used to the advantage of the attacker. For example, if an error is printed, it might leak some information to the attacker. If an error occurred during authentication, it could create open-on-fail conditions, allowing the attacker to get an unauthorized session.
To prevent denial-of-service (DoS) attacks from user input, validate any and all input from outside the application (user input, file input, system parameters, and so on). Validation should include bounds validation using information from an appropriate, accessible container.
SV.DOS.ARRINDEX is reported for line 27: 'indexString' contains a value coming from an HTTP request and thus can be tainted (line 18). On line 21 tainted 'indexString' is parsed and stored in 'index' which is used to access an array element on line 27. A potential attacker can specify a large number, leading to an ArrayOutOfBounds exception, which can damage the state of the application and lead to a DoS attack.