Denial of Service (DoS) vulnerabilities allow attackers to disrupt service availability by exhausting system resources or exploiting flawed logic.

These vulnerabilities highlight risks in input validation, resource management, and architectural design that attackers exploit to disrupt services.

SQL Wildcard Vulnerability

CPU exhaustion: Malicious wildcard queries (e.g., `%` in SQL Server) force full-table scans, consuming database CPU. For example, `LIKE ‘%a%a%a%’` triggers exponential processing in large datasets. 

Application-layer impact: Search features in CMS or e-commerce platforms may process excessive records, overwhelming application servers. 

Locking Customer Accounts 

Authentication abuse: Repeated failed login attempts trigger account lockouts, denying legitimate users access. Attackers automate credential stuffing to exhaust lockout thresholds.

Resource strain: Lockout mechanisms that log events or send notifications can overload systems under sustained attacks. 

Buffer Overflows

Memory corruption: User inputs exceeding allocated buffer sizes crash applications or enable arbitrary code execution. For example, oversized HTTP headers or payloads exploit web server vulnerabilities. 

Session handling: Overloaded session variables (e.g., storing large files) cause application layer failures. 

User-Specified Object Allocation 

Resource exhaustion: Allowing users to define object sizes (e.g., arrays or files) leads to excessive memory/disk consumption. For instance, uploading a 10GB file to a service with no size limits. 

Unbounded growth: Dynamic allocation without constraints enables attackers to deplete system resources (e.g., creating millions of temporary objects). 

User Input as a Loop Counter

Infinite loops: Maliciously crafted integers (e.g., `1000000000`) force applications into computationally intensive loops, starving CPU resources

Unexpected behavior: Unvalidated loop counters bypass security controls, enabling unauthorized actions or crashes

Writing User-Provided Data to Disk

Storage saturation: Large files or high-volume data submissions fill disk space, preventing logging or critical operations. Log files with unrestricted growth are prime targets.

CRC manipulation: Incomplete or malformed uploads trigger repeated CRC checks, consuming I/O resources.

Failure to Release Resources

Connection leaks: Unclosed database connections, file handles, or network sockets deplete available pools, blocking legitimate users. 

Memory leaks: Poorly managed session data or caching mechanisms gradually exhaust server memory. 

Storing Too Much Data in Session

Session overflow: Overloading session variables (e.g., storing large datasets) crashes application servers or slows response times.

Complex session objects: Serializing large objects (e.g., images) increases CPU/memory usage during session handling.