Findings

Undefined integer limit

Updated: June 19, 2025

findings design based findings api finding

Description

An endpoint is missing limit information for an integer parameter.

Remediation

Determine the possible range of values for the parameter and specify the appropriate limits. Integers should be limited to mitigate resource exhaustion attacks. This can be done using `minimum` and `maximum`, for exaomle, avoiding negative numbers when a positive number is expected, or reducing unreasonable iterations for example, doing something 1000 times when 10 is expected.

Security Frameworks

OWASP API 2023

API4:2023 Unrestricted Resource Consumption

Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs.

OWASP API 2023

API4:2019 Lack of Resources and Rate Limiting

Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only can this impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force.

MITRE CWE Top 25

CWE-20: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Need help?

Contact FireTail support

Previous (Findings - Design based findings)
Undefined integer format
Next (Findings - Design based findings)
Undefined string limit