thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Unrestricted Resource Consumption

API4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.

Definition

Resources include CPU, memory, bandwidth, storage and paid third-party services such as SMS or AI inference. Missing limits on request rate, payload size, pagination size or query complexity are typical. Mitigations include rate limiting, quotas, timeouts, maximum page sizes, GraphQL depth limits and spending alerts.

Example

An attacker triggers 100,000 password-reset SMS messages, generating a large telecom bill.

Exam tip

Includes financial exhaustion, not just availability; renamed from Lack of Resources and Rate Limiting.

Related terms