Findings

Undefined integer format

Updated: June 19, 2025

Description

An endpoint is missing format information for an integer parameter.

Remediation

Determine the business requirements for the parameter and specify an appropriate format. Integers should be limited to mitigate resource exhaustion attacks. Specifying whether int32 or int64 is expected using `format`.

Security Frameworks

Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs.

Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force.

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Need help?

Contact FireTail support

Previous (Findings - Design based findings)
Unconstrained additional properties
Next (Findings - Design based findings)
Undefined integer limit