What is resource exhaustion?
Resource exhaustion attack - a type of attack aimed at depleting a system's resources and disrupting its ability to provide service.
How it works
An attacker sends specially crafted requests or data to overload the system's CPU, memory, or other resources, resulting in a denial of service.
Defense checklist5
- 01
Regularly update systems and software
- 02
Implement strong authentication and authorization mechanisms (MFA)
- 03
Limit the volume of requests and data
- 04
Monitor system resources and scale as needed
- 05
Update and enforce security policies and procedures
Real-world evidence
CVE-2026-13064, CVE-2026-13069, CVE-2026-42792, CVE-2026-67317, CVE-2026-70616, and CVE-2026-13051 incidents are examples of resource exhaustion attacks. In these incidents, attackers exploited vulnerabilities in MongoDB, Erlang OTP erts (epmd), axios, boringproxy, and Form::Processor::Field::HtmlArea to cause resource exhaustion.
Sources
- CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger dispronvd
- CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on anvd
- CVE-2026-42792: Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allowsnvd
- CVE-2026-67317: axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStreamnvd
- CVE-2026-70616: boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any aunvd
- CVE-2026-13051: Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacknvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.