STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must employ throttling.

DISA Rule

SV-274612r1143931_rule

Vulnerability Number

V-274612

Group Title

SRG-APP-000247

Rule Version

SRG-APP-000247-API-000520

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Build or configure the API to employ throttling to limit the effects of information flooding attacks.

Check Contents

Review the API architecture documentation and identify solutions that provide API DoS protections.

Verify the API employs throttling to limit the effects of information flooding attacks.

This includes:
- Requests per second.
- Sliding window algorithm.
- Request queues.
- Reduce parallelism and call frequency.

If the API does not employ throttling to limit the effects of information flooding attacks, this is a finding.

Vulnerability Number

V-274612

Documentable

False

Rule Version

SRG-APP-000247-API-000520

Severity Override Guidance

Review the API architecture documentation and identify solutions that provide API DoS protections.

Verify the API employs throttling to limit the effects of information flooding attacks.

This includes:
- Requests per second.
- Sliding window algorithm.
- Request queues.
- Reduce parallelism and call frequency.

If the API does not employ throttling to limit the effects of information flooding attacks, this is a finding.

Check Content Reference

M

Target Key

5703