https://nalar.dev/tags/resource-exhaustion/ Recent content in Resource Exhaustion on Nalar Hugo en-us Thu, 10 Sep 2026 00:00:00 +0700 https://nalar.dev/limit-decompression-before-untrusted-data-exhausts-resources/ Thu, 10 Sep 2026 00:00:00 +0700 https://nalar.dev/limit-decompression-before-untrusted-data-exhausts-resources/ <p>A service may reject a 100 MB upload and still accept a much smaller compressed file that expands far beyond the memory or storage the service can afford. The upload limit measured the bytes crossing one boundary. The expensive work happens after that boundary, when the application decompresses, parses, indexes, scans, or stores the expanded data.</p> <p>This is the practical problem behind decompression bombs: compact input can cause disproportionate resource use when software expands it without enforcing a budget on the result. The consequence is usually availability loss rather than unauthorized access. Workers can run out of memory, temporary storage can fill, CPU time can be consumed, and a queue of expensive jobs can delay ordinary requests.</p>