Route accepts large response from external APIs
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Description
An API endpoint accepts large responses from external APIs without enforcing size limits. When an application blindly consumes responses of arbitrary size, it becomes vulnerable to resource exhaustion attacks. A malicious or compromised third-party API could send an oversized response, leading to excessive memory consumption, denial of service, or buffer-related vulnerabilities.
Rationale
This finding works by identifying an API route that receives responses from external APIs where the response body exceeds expected size thresholds, indicating a lack of proper response size validation.
- Enforce maximum response size limits when consuming external API responses
- Implement streaming or chunked reading with size checks to prevent loading entire large payloads into memory
- Set appropriate timeouts and resource limits for external API calls
References
