Denial of Service

other MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

How It Works

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions. Attackers exploit asymmetry: minimal attacker effort produces disproportionate resource consumption on the target. Application-level attacks use specially crafted inputs that trigger expensive operations—a regex engine processing malicious patterns can backtrack exponentially, or XML parsers recursively expand entities until memory exhausts. Network-level attacks flood targets with connection requests or amplify traffic through reflection, but application vulnerabilities often provide the most efficient attack surface.

The attack typically begins with reconnaissance to identify resource-intensive operations or unprotected endpoints. For algorithmic complexity attacks, adversaries craft inputs hitting worst-case performance—hash collision inputs filling hash tables with collisions, deeply nested JSON triggering recursive parsing, or pathological regex patterns like (a+)+b against strings of repeated 'a' characters. Resource exhaustion attacks open thousands of connections, upload massive files to unbounded storage, or trigger memory leaks through repeated operations. Crash-based attacks target error handling gaps: null pointer dereferences, unhandled exceptions in parsers, or assertion failures that terminate processes.

Impact

Service unavailability preventing legitimate users from accessing applications during attack duration
Revenue loss from downtime in e-commerce, SaaS platforms, or transaction processing systems
Cascading failures as resource exhaustion spreads to dependent services or database connections pool out
SLA violations triggering financial penalties and damaging customer trust
Security team distraction providing cover for data exfiltration or intrusion attempts running concurrently

Real-World Examples

CVE-2018-1000544 in Ruby's WEBrick server allowed ReDoS through malicious HTTP headers containing specially crafted patterns that caused the regex engine to backtrack exponentially, freezing request processing threads. A single attacker could saturate all available workers.

Cloudflare experienced a global outage in 2019 when a single WAF rule containing an unoptimized regex hit pathological cases on legitimate traffic spikes. The .*(?:.*=.*)* pattern exhibited catastrophic backtracking, consuming CPU cycles across their edge network until the rule was disabled.

CVE-2013-1664 demonstrated XML bomb vulnerabilities in Python's XML libraries. Attackers uploaded XML documents with nested entity definitions-each entity expanding to ten copies of the previous level. A 1KB upload could expand to gigabytes in memory during parsing, crashing applications instantly.

Mitigation

Strict input validation enforcing size limits, complexity bounds, and nesting depth restrictions before processing
Request rate limiting per IP address, API key, or user session with exponential backoff
Timeout enforcement terminating operations exceeding reasonable execution windows (typically 1-5 seconds)
Resource quotas limiting memory allocation, CPU time, and connection counts per request or tenant
Regex complexity analysis using linear-time algorithms or sanitizing patterns to eliminate backtracking
Circuit breakers automatically rejecting requests when error rates or latency thresholds indicate degradation
Load balancing and autoscaling distributing traffic across instances with automatic capacity expansion

Recent CVEs (40240)

CVE-2019-2395

EPSS 1% CVSS 5.4

MEDIUM PATCH This Month

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Denial Of Service Oracle Weblogic Server

NVD

CVE-2019-6462

EPSS 2% CVSS 6.5

MEDIUM POC This Month

An issue was discovered in cairo 1.16.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Denial Of Service Cairo Cairographics

NVD GitHub

CVE-2019-6461

EPSS 2% CVSS 6.5

MEDIUM POC This Month

Denial Of Service Cairo Cairographics

NVD GitHub

CVE-2019-6460

EPSS 1% CVSS 6.5

MEDIUM POC This Month

An issue was discovered in GNU Recutils 1.8. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Denial Of Service Null Pointer Dereference Recutils +1

NVD GitHub

CVE-2019-6456

EPSS 1% CVSS 6.5

MEDIUM POC This Month

Denial Of Service Null Pointer Dereference Recutils +1

NVD GitHub

CVE-2019-6445

EPSS 14% CVSS 6.5

MEDIUM POC THREAT This Month

An issue was discovered in NTPsec before 1.1.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Denial Of Service Null Pointer Dereference Ntpsec

NVD GitHub Exploit-DB

CVE-2019-3554

EPSS 1% CVSS 5.9

MEDIUM PATCH This Month

Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service Facebook Wangle

NVD GitHub

CVE-2019-0014

EPSS 2% CVSS 7.5

HIGH PATCH This Week

On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.