Denial of Service

Bound Work Before Processing Untrusted Input

An input does not need to be malicious code to hurt a service. It only needs to make the service spend far more memory, CPU time, storage, or concurrency than the sender spent creating the request. A parser may accept deeply nested data. A compressed upload may expand far beyond its transfer size. A search endpoint may allow a query that is valid but unusually expensive. If enough work begins before the application applies a limit, a small amount of incoming traffic can consume resources needed by legitimate users.