Rule Definition
When web pages have a large amount of post data it can potentially lead to exhaustion of resources even with lesser number of sessions/calls. Attackers can hence make possible Denial of Service with less number of requests. The default limit for the following client side dictionaries is 1000 but changing them to a higher number poses a security risk.

Remediation
Never change the maxHttpCollectionKeys to more than , X being the customizable limit

Violation Code Sample

...
  <appSettings>
    <add key="aspnet:MaxHttpCollectionKeys" value="21474836" />
  </appSettings>
...

Fixed Code Sample

...
  <appSettings>
    <add key="aspnet:MaxHttpCollectionKeys" value="<less than 1000>" /> //fixed
  </appSettings>
...
OR
Do not specify MaxHttpCollectionKeys at all

https://docs.microsoft.com/en-us/previous-versions/aspnet/hh975440(v=vs.120)?redirectedfrom=MSDN https://cwe.mitre.org/data/definitions/730.html