Definition

Unrestricted Resource Consumption occurs when an API does not properly limit how much resource a user or attacker can consume.

This includes limits on:

• Requests per second (rate limiting)
• Data volume returned
• Memory usage
• CPU processing time
• File upload size
• Execution timeouts

Core idea

If an API does not control resource usage, attackers can overload it through:

• High-volume requests
• Automated scripts
• Botnets or distributed traffic

This can degrade performance or completely take the service down.

Common attack types

• Mass data harvesting