Security: Consider CWE and CAPEC

One security habit that improved my engineering decisions: before shipping a feature, I quickly check related CWE and CAPEC entries.

I do not treat them as theory. I use them as practical lists of weakness classes and attack patterns that can happen in real systems.

Three useful examples:

1. CWE-284: Improper Access Control
2. CWE-834: Excessive Iteration
3. CAPEC-231: Oversized Serialized Data Payloads

Example 1: Large Pagination Per Page Items

Suppose your pagination API accepts an items_limit parameter directly from the client.

If an attacker sends items_limit=999999999999, your service can start doing expensive work that should never happen:

1. CPU and memory pressure on the application server
2. Extra load and query cost on the RDS instance
3. Bandwidth waste by sending massive JSON payloads
4. More CPU spent on JSON serialization

This is not just a “performance bug.” It’s a vulnerability that allows the attackers to take down your systems anytime they want.

How to Avoid It

1. Enforce strict upper bounds for pagination (min/max on input).
2. Apply sane defaults when clients omit or abuse limits.
3. Add request-level safeguards (timeouts, rate limits, and query guards).
4. Add monitoring for unusual request shapes (for example, repeated high-limit calls).

Example 2: Oversized JSON Payload

A client can also send a JSON payload that is big enough (even 5MB) to block request-processing threads.

A dozen such malicious requests can effectively halt backend request processing by consuming CPU and memory during parsing and serialization work.

How to Avoid It

1. Enforce maximum JSON payload size (separate from file upload limits).
2. Prefer enforcing payload limits at the edge or load balancer, before the app parses JSON.
3. If edge enforcement is not possible, enforce it in application middleware before JSON serialization/parsing as a last resort.

Conclusion

Security reviews become much better when we map features to known weakness classes and attack patterns early.

A quick CWE/CAPEC check (with the big help of GPT) can expose problems before they become incidents.