拒绝服务

用很小的输入消耗很多资源。正则回溯、解压炸弹和无限循环是常客。

影响

使服务不可用，影响所有正常用户

观察点

单个请求即可让服务 CPU 或内存长时间处于高位

修复

为解析与计算设置资源上限和超时，使用线性时间的正则引擎，并对外部输入做大小限制。

弱点分布

• 资源消耗失控526
• Allocation of Resources Without Limits or Throttling28
• 拒绝服务19
• Unlabeled16
• Uncontrolled Recursion2
• 违反安全设计原则（按标题归类）2
• Improper Handling of Highly Compressed Data (Data Amplification)1
• Improper Resource Shutdown or Release1
• LLM04: Model Denial of Service1
• Loop with Unreachable Exit Condition ('Infinite Loop')1

共现类别

暂无共现数据。

高票报告

当前状态 597 份 · 全部 597 · 筛选赏金 $320,242

1. 851
   DoS on PayPal via web cache poisoningPayPal · 2019-10-24 · 中危
   $9,700资源消耗失控
2. 475
   profile-picture name parameter with large value lead to DoS for other users and programs on the platformHackerOne · 2020-03-25 · 中危
   $0资源消耗失控
3. 405
   Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerAutomattic · 2020-04-16 · 中危
   $0资源消耗失控
4. 323
   [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableX / xAI · 2019-04-26 · 未评级
   $0资源消耗失控
5. 264
   Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)LocalTapiola · — · 未评级
   $18,000资源消耗失控
6. 253
   Denial of service via cache poisoningHackerOne · 2018-12-23 · 中危
   $2,500资源消耗失控
7. 228
   Static files on HackerOne.com can be made inaccessible through Cache Poisoning attackHackerOne · 2021-12-23 · 中危
   $0资源消耗失控
8. 210
   Uploading large payload on domain instructions causes server-side DoSHackerOne · 2020-06-20 · 中危
   $2,500资源消耗失控
9. 164
   Bypass password reset rate limit protection at moneybird.com/passwordsMoneybird · 2019-12-22 · 高危
   $0资源消耗失控
10. 162
    xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)Nord Security · — · 未评级
    $0资源消耗失控
11. 161
    Node disk DOS by writing to container /etc/hostsKubernetes · 2020-07-22 · 中危
    $1,000资源消耗失控
12. 149
    Enable 2FA without verifying the emailMoneybird · 2019-10-25 · 中危
    $0资源消耗失控
13. 145
    DoS on the Issue page by exploiting Mermaid.GitLab · 2019-05-14 · 中危
    $3,000资源消耗失控
14. 142
    url that twitter mobile site can not loadX / xAI · 2019-03-20 · 低危
    $1,120资源消耗失控
15. 141
    character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorX / xAI · 2020-05-07 · 中危
    $0资源消耗失控
16. 138
    Multiple endpoints are vulnerable to XML External Entity injection (XXE)Pornhub · — · 未评级
    $2,500拒绝服务
17. 132
    a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of serviceBasecamp · 2020-11-10 · 高危
    $1,000资源消耗失控
18. 127
    Permanent DoS with one click.Automattic · 2020-11-19 · 中危
    $0资源消耗失控
19. 121
    DOS of RSKJ serverRootstock Labs · 2025-06-13 · 高危
    $5,000资源消耗失控
20. 111
    ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pagesHackerOne · 2019-12-14 · 中危
    $0资源消耗失控
21. 110
    Cache Poisoning DoS on downloads.exodus.comExodus · 2021-12-23 · 高危
    $0资源消耗失控
22. 109
    Denial of Service via Hyperlinks in PostsSlack · 2021-10-03 · 中危
    $1,500资源消耗失控
23. 108
    Unsufficent input verification leads to DoS and resource consumptionSorare · 2025-02-26 · 低危
    $300资源消耗失控
24. 98
    Denial of Service (DoS) Vulnerability in Drafts Creation EndpointDiscourse · 2026-06-30 · 高危
    $1,024资源消耗失控
25. 97
    Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node ParalysisMonero · 2026-05-07 · 严重
    $0资源消耗失控