10. of Denial of Service

An attacker can make a server unavailable or unusable without ever authenticating, and the problem persists after the attacker goes away (server, anonymous, persistent).

Threat
	You have a file upload endpoint that doesn’t limit the file size, so an attacker sends enough data to fill the storage on the server and stop it from being able to further process requests.
CAPEC	CAPEC-231 – Oversized serialized data payloads CAPEC-572 – artificially inflate file sizes
ASVS	5.2.2 – Ensure data is sanitized
CWE	CWE-400 – Uncontrolled resource consumption

Mitigations

...