QID 570075

QID 570075: Array Size Limits Not Defined

Array size should be limited to mitigate resource exhaustion attacks. An analysis of the swagger file has determined that maxItems is not defined for the array defined on the API end point.

Swagger file is not compliant to swagger specification. Analysis will result in an error. Consumers of API will not have clarity and can accidentally use more resources resulting in exhausting the resources. Attackers can take advantage to attack the end point since the max limit is not specified on the array.

CVSS V3 rated as Low - 0 severity.

CVSS V2 rated as Low - 0 severity.

Solution

Ensure that maxItems has been specified. For example:
components: schemas: UsersList: type: array maxItems: 99

Vendor References

CVEs related to QID 570075

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].