Skip to main content
Input causing excessive resource usage (memory, CPU, disk).

​
How to resolve

Implement size limits: Check the size of user input (file uploads, array lengths, string sizes) before allocating resources or processing. Add timeouts: Set execution time limits for resource-intensive operations to prevent unbounded processing. Use resource quotas: Implement per-user or per-request resource quotas for memory, CPU, and disk usage. Validate input complexity: For operations with computational complexity (regex matching, parsing), validate input patterns to prevent algorithmic complexity attacks.

​
Risk

Governance/Compliance Resource exhaustion vulnerabilities violate multiple security standards:
  • CWE-400 (Uncontrolled Resource Consumption): Lack of resource limits enables denial-of-service attacks.
  • OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption): Fails to implement rate limiting and resource quotas.
  • NIST SP 800-53 (SC-5): Does not protect against denial-of-service attacks through resource depletion.
  • OWASP MCP Top 10 (MCP05:2025 - Command Injection & Execution): Uncontrolled resource consumption in MCP servers can be exploited through crafted tool invocations.
Security An attacker can cause denial of service by submitting input that triggers excessive resource consumption, making the MCP server unresponsive or causing it to crash. This can impact availability for legitimate users and potentially affect other services sharing the same infrastructure. While typically less severe than code execution vulnerabilities, sustained resource exhaustion can disrupt business operations.

​
Explanation

Resource exhaustion vulnerabilities occur when user-controlled input can trigger excessive consumption of system resources like memory, CPU, or disk space without proper limits. The scanner checks for resource-intensive operations that lack size or iteration limits on user-provided data. This can be prevented by implementing bounds checking, timeouts, and resource quotas before processing untrusted input.

​
Specifications

Trigger
  • MCP server scan detects resource-intensive operations (memory allocation, loops, file processing) without limits on user-controlled input
Severity
  • LOW
Applies to: MCP Server