CME-906
Rate Limiting / Connection Throttling
Description
Limits request rate per client IP or authenticated identity. Mitigates brute force attacks, credential stuffing, and application-level denial of service from single-source attackers. Does not protect against distributed attacks across many source IPs.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Availability (A) | H → L | Per-IP request throttling caps the rate at which any single source can consume application resources (connections, threads, CPU), preventing single-source request flooding from exhausting capacity for other clients |
| Attack Complexity (AC) | L → H | Per-IP throttling limits authentication attempts to a rate that makes dictionary and brute force attacks from a single source impractical (e.g., 5 attempts/minute vs thousands/second) |
CWE Relationships
Verification
Verify rate limiting is configured in the web server or reverse proxy
$ grep -r 'limit_req_zone' /etc/nginx/ 2>/dev/null
# Expected: limit_req_zone
# Expected: limit_req_zone
Platform: linux
$ grep -rE 'mod_ratelimit|mod_evasive' /etc/httpd/conf*/ /etc/apache2/ 2>/dev/null
# Expected: mod_ratelimit
# Expected: mod_ratelimit
Platform: linux
$ Get-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'IIS:\Sites\Default Web Site' -Name enabled
# Expected: True
# Expected: True
Platform: windows