🎄 Join our Annual Holiday wargame and win prizes!


Missing Throttlling

When applications fail to enforce throttling or rate limiting on incoming requests, adversaries can issue a large number of repetitive requests in a short time. This can exhaust system resources and cause denial of service, or allow large-scale attacks such as credential stuffing, brute-force authentication, and mass data scraping. Without proper limits, attackers can automate abuse at scale with little resistance.

Remediation

  • Apply rate limiting on all exposed endpoints (REST, GraphQL, gRPC, etc.) according to business requirements and acceptable usage thresholds.
  • Implement dynamic throttling strategies such as IP-based, user-based, or token-based limits.
  • Use exponential backoff or progressive delays after repeated requests to make automation less effective.
  • Monitor for distributed attack patterns (e.g., botnets) and combine rate limiting with anomaly detection.
  • Consider CAPTCHAs or secondary challenges for endpoints prone to brute-force or scraping attacks.

Metadata

  • Severity: low
  • Slug: missing-throttlling

CWEs

  • 770: Allocation of Resources Without Limits or Throttling
  • 400: Uncontrolled Resource Consumption
  • 307: Improper Restriction of Excessive Authentication Attempts

OWASP

  • A05:2021: Security Misconfiguration

Available Labs

Select a language to explore available labs for this vulnerability.

No matching labs found

Try adjusting your language filter.

Deco line
Deco line

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now
Deco line
Deco line

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.

Read more