Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

This pattern forces the application to handle data piecemeal, creating significant performance overhead. Each request adds network latency and processing time, slowing down the entire operation. While what constitutes "excessive" can vary by context, a common guideline (like CISQ's) suggests limiting functions to a maximum of two data access calls to maintain responsiveness. If an attacker can trigger this inefficient code path, the performance degradation can be exploited to cause denial-of-service (DoS) by exhausting server resources. To fix this, developers should consolidate data requests, implement server-side filtering or aggregation, and leverage the data layer's built-in efficient querying features instead of manual, iterative fetching.