Missing array limit

Updated: June 19, 2025

Description

An endpoint is returning an array of items without having a specified limit on the maximum number of items that can be returned. Array size should be limited to mitigate resource exhaustion attacks.

Remediation

Determine an appropriate limit based on business needs and implement this limit on the affected endpoint. This can be done for example, using `maxItems`. You could also check that the subschema in `items` is constrained too. If you need to return a large amount of items, use pagination.

Security Frameworks

OWASP API 2023

API4:2023 Unrestricted Resource Consumption

Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs.

OWASP API 2019

API4:2019 Lack of Resources and Rate Limiting

Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force.

MITRE CWE Top 25

CWE-20: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.