Resource Exhaustion

2 articles

Cybersecurity 11 Sep 2026 9 min read

Bound Password Verification Work to Resist Resource Exhaustion

Password hashing is intentionally expensive. That cost makes each offline password guess more expensive after a verifier database is stolen. The same property creates an operational risk on a live login endpoint: an unauthenticated client can ask the server to perform costly password verification again and again. A service that treats every login attempt as unlimited work can exhaust CPU, memory, worker slots, or downstream capacity before an attacker needs a valid account. The defensive goal is not to make password hashing cheap. It is to preserve a suitable password-hashing cost while placing firm limits around how much verification work the service will accept at once.

Cybersecurity Authentication

Cybersecurity 10 Sep 2026 10 min read

Limit Decompression Before Untrusted Data Exhausts Resources

A service may reject a 100 MB upload and still accept a much smaller compressed file that expands far beyond the memory or storage the service can afford. The upload limit measured the bytes crossing one boundary. The expensive work happens after that boundary, when the application decompresses, parses, indexes, scans, or stores the expanded data. This is the practical problem behind decompression bombs: compact input can cause disproportionate resource use when software expands it without enforcing a budget on the result. The consequence is usually availability loss rather than unauthorized access. Workers can run out of memory, temporary storage can fill, CPU time can be consumed, and a queue of expensive jobs can delay ordinary requests.

Cybersecurity Secure Coding