Denial of service
Making a service unavailable to legitimate users by exhausting a resource such as CPU, memory, connections, disk or a paid quota, or by crashing it (CWE-400). In applications it often comes from unbounded input sizes, expensive queries, ReDoS or decompression bombs rather than from traffic volume.
- Also called
- DoS
- Fix it in your stack
- Unbounded resource consumption fix cards (4 stacks) · CWE-400 page
- Defined in
- MITRE CWE-400
- Identifiers
- CWE-400: Uncontrolled resource consumption
Covered in
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Validate input safely and prevent regex denial of service
Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Keep HTTP services up under application-layer DDoS
Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
Apply security limits to GraphQL, WebSocket and gRPC operations
Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
All 9 pages that cover Denial of service in the library
Practice: Local project: Repair a real proxy and shared cache · Local project: Convert untrusted documents in a locked-down container