How to fix Unrestricted Resource Consumption
in .NET 8 Web API
Executive Summary
Unrestricted resource consumption in .NET 8 APIs is a low-effort DoS vector. Attackers spray high-volume requests or massive payloads to exhaust thread pools, RAM, or disk I/O. Without explicit constraints, Kestrel and the CLR will try to satisfy every greedy request until the process OOMs (Out of Memory) or the CPU hits 100%, effectively killing the service for legitimate users.
The Vulnerable Pattern
[HttpPost("process-data")]
public async Task Process([FromBody] List items)
{
// VULNERABILITY: No limit on list size or request body.
// An attacker can send a 500MB JSON array, forcing the CLR to allocate massive objects on the LOH.
foreach (var item in items)
{
await _service.ProcessAsync(item);
}
return Ok();
} The Secure Implementation
The secure implementation applies three layers of defense: 1. Rate Limiting (FixedWindow) prevents automated flooding of the endpoint. 2. RequestSizeLimit attribute instructs Kestrel to drop connections exceeding the specified byte count before the application even attempts to deserialize the payload, preventing RAM exhaustion. 3. Logical count validation ensures the business logic doesn't iterate over an unexpectedly large collection that could spike CPU usage. Use these to maintain availability under adversarial conditions.
// Program.cs configuration builder.Services.AddRateLimiter(options => { options.AddFixedWindowLimiter("api-limit", opt => { opt.PermitLimit = 100; opt.Window = TimeSpan.FromSeconds(60); opt.QueueLimit = 0; }); });// Controller implementation [HttpPost(“process-data”)] [EnableRateLimiting(“api-limit”)] [RequestSizeLimit(1024 * 100)] // Limit total payload to 100KB public async Task
Process([FromBody] List items) { // SECURE: Enforce a logical limit on the collection size if (items.Count > 50) return BadRequest(“Too many items.”); foreach (var item in items) { await _service.ProcessAsync(item); } return Ok();
}
Your .NET 8 Web API API
might be exposed to Unrestricted Resource Consumption
74% of .NET 8 Web API apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.