What is resource exhaustion?
Resource exhaustion attack - a type of attack aimed at depleting a system's resources and disrupting its ability to provide service.
Azərbaycanca: Resursların tükənməsi hücumu (resource exhaustion) - sistemin resurslarını tükədərək xidmət göstərmə qabiliyyətini pozmağa yönəlmiş hücum növü.
How it works
An attacker sends specially crafted requests or data to overload the system's CPU, memory, or other resources, resulting in a denial of service.
Defense checklist5
- 01
Regularly update systems and software
- 02
Implement strong authentication and authorization mechanisms (MFA)
- 03
Limit the volume of requests and data
- 04
Monitor system resources and scale as needed
- 05
Update and enforce security policies and procedures
Real-world evidence
CVE-2026-13064, CVE-2026-13069, CVE-2026-42792, CVE-2026-67317, CVE-2026-70616, and CVE-2026-13051 incidents are examples of resource exhaustion attacks. In these incidents, attackers exploited vulnerabilities in MongoDB, Erlang OTP erts (epmd), axios, boringproxy, and Form::Processor::Field::HtmlArea to cause resource exhaustion.
Sources
- CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger dispronvd
- CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on anvd
- CVE-2026-42792: Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allowsnvd
- CVE-2026-67317: axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStreamnvd
- CVE-2026-70616: boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any aunvd
- CVE-2026-13051: Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacknvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.