Cybersecurity glossary
What is Denial of Service (DoS)?
Learn what Denial of Service (DoS) is as an availability attack category, how it differs from DDoS and resource exhaustion, common application and network forms, and how to reduce impact.
Definition
Denial of Service (DoS) is a category of attack that intentionally impairs the availability of a system, service, or network resource so legitimate users cannot use it when needed—whether by crashing a host, exhausting capacity, or otherwise disrupting normal operation.
Why Denial of Service matters
Security is not only secrecy. Denial of Service (DoS) is the umbrella category for attacks that remove availability—the ability of customers, APIs, and operators to use a system when they need it. Outages destroy trust, trigger SLA breaches, and can mask other intrusions.
DoS covers many techniques: floods, protocol abuse, Slowloris, ReDoS, and compression bombs. DDoS is the distributed subset; resource exhaustion describes how many application-layer DoS paths actually break the app.
How DoS attacks typically progress
Choose an availability target
Pick a public site, API, DNS name, login path, or shared dependency whose downtime hurts users.
Select a mechanism
Use network volume, protocol quirks, expensive application work, or slow connections—whatever fits the stack.
Drive the service past capacity
Saturate bandwidth, sockets, CPU, memory, disk, or thread pools beyond what normal traffic uses.
Degrade legitimate access
Errors, timeouts, and queue backups appear for real users while the attack continues.
Optionally amplify or persist
Attackers may switch vectors, target failovers, or combine DoS with other objectives.
Force response costs
Operators spend time on mitigation, incident response, and capacity—availability remains the battleground.
DoS as a category (not one technique)
Network / protocol DoS
Bandwidth or packet floods and protocol state abuse that overwhelm NICs, firewalls, or stacks.
Application-layer DoS
Cheap-to-send requests that force expensive work: queries, uploads, regex, or decode.
Slow-connection DoS
Techniques like Slowloris hold workers open so new clients cannot connect.
Dependency DoS
Knocking over a shared cache, auth provider, or database denies many upstream apps at once.
Prevention
| Practice | Detail |
|---|---|
| Assume availability is in scope | Treat DoS scenarios in threat models alongside XSS and injection—not only as “ops traffic.” |
| Bound expensive work | Timeouts, size limits, query budgets, and rate limits shrink application-layer DoS surface. |
| Plan capacity and failover | Redundancy, caching, and graceful degradation reduce blast radius when load spikes. |
| Distinguish DDoS controls | Edge scrubbing and CDN/WAF help distributed floods; they do not replace app resource budgets. |
- Map which DoS techniques apply to your stack: flood, Slowloris, ReDoS, decode bombs, costly APIs.
- Define SLOs and alerts for latency, error rate, saturation, and connection pool usage.
- Enforce rate limits and authentication where anonymous expensive endpoints exist.
- Add fail-closed budgets for uploads, regex, and decompression—see related glossary pages.
- Practice incident runbooks that separate network DDoS from single-host application DoS.
- Review [security misconfiguration](/glossary/security-misconfiguration) that leaves debug endpoints or unlimited uploads exposed.
- Load-test realistic attack shapes, not only happy-path traffic.
- Remember: DoS is the category; pick defenses that match the specific mechanism.
The practical takeaway
Denial of Service (DoS) names the goal—deny availability—not a single packet type. DDoS, ReDoS, Slowloris, and resource exhaustion are ways that goal is achieved.
If your threat model ignores availability, attackers only need to find the cheapest way to make your service stop answering.
Related security terms
Distributed Denial of Service (DDoS)
DoS delivered from many coordinated sources, often volumetric or multi-vector.
Resource Exhaustion
App-level CPU, memory, disk, and connection exhaustion as a DoS mechanism.
Regular Expression Denial of Service (ReDoS)
A specific DoS technique using catastrophic regex backtracking.
Slowloris
A slow-connection DoS that holds server workers open with incomplete requests.
Frequently asked questions
What is DoS in simple terms?
An attack that makes a website or service unavailable—so real users get errors, timeouts, or blank pages—even if confidentiality of data is not the goal.
How is DoS different from DDoS?
DoS is the general category of availability attacks. DDoS is a distributed form that uses many machines or bots at once.
Is every outage a DoS attack?
No. Misconfiguration, bugs, and traffic spikes can cause similar symptoms. DoS implies intentional impairment of availability.
What are common DoS techniques?
Network floods, protocol abuse, application-layer expensive requests, [Slowloris](/glossary/slowloris)-style connection holds, ReDoS, and decompression bombs.
Where does DoS fit in the CIA triad?
It targets availability—the “A”—while confidentiality and integrity attacks target the other properties.
Can a single request cause DoS?
Yes at the application layer: one pathological query, regex, or decode can stall a process. Network DoS more often needs sustained traffic.
How do you defend against DoS?
Capacity planning, rate limits, timeouts, input/size budgets, caching, redundancy, and—for distributed floods—edge filtering and scrubbing.
References
Explore authoritative guidance and frameworks related to denial of service (dos).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.