Cybersecurity glossary
What is Resource Exhaustion?
Learn what resource exhaustion is at the application layer—CPU, memory, disk, and connection pool depletion—how it enables DoS, how it relates to unrestricted resource consumption, and how to set budgets.
Definition
Resource exhaustion is a condition—often attacker-induced—in which an application or its host runs out of a finite resource such as CPU, memory, disk space, file descriptors, or network connections, causing failures, severe slowdowns, or denial of service for legitimate users.
Why resource exhaustion matters
Applications run on finite pools: CPU cores, heap, disk inodes, file descriptors, database connections, and worker threads. Resource exhaustion is what happens when those pools hit the wall—often because attackers (or unbounded features) force allocation without matching release or limits.
It is the mechanism behind many DoS outcomes and the practical failure mode behind unrestricted resource consumption. Techniques like decompression bombs, ReDoS, and Slowloris are specific ways to empty different pools.
How application-level exhaustion unfolds
Identify an unbounded sink
Find uploads, queries, regex, decode, or connection handling without size, time, or concurrency caps.
Drive costly or numerous operations
Send heavy payloads, slow connections, or parallel expensive calls that allocate faster than reclaim.
Deplete a critical pool
CPU saturates, memory approaches OOM, temp disks fill, or connection/thread pools hit max.
Starve legitimate work
Healthy requests wait on exhausted workers, locks, or I/O and begin timing out.
Cascade across dependencies
Retries amplify load; shared databases and caches fail open for other services.
Lose availability
The service errors or restarts until limits, isolation, and capacity restore headroom.
Resources attackers target
CPU
Pathological regex, crypto, or queries monopolize cores and block request workers.
Memory
Large allocations from payloads, caches, or decode buffers push processes toward OOM.
Disk
Extracts, logs, and uploads fill volumes used for temp files and persistent storage.
Connections & threads
Slowloris-style holds and leaks exhaust sockets, DB pools, and thread limits.
Prevention
| Practice | Detail |
|---|---|
| Budget every sink | Hard-cap payload size, query cost, decode ratio, regex time, and concurrent connections per client. |
| Timeout and backpressure | Fail closed with deadlines and queue limits instead of accepting unbounded work. |
| Isolate heavy paths | Run extractors, reports, and media jobs in separate pools so they cannot starve interactive APIs. |
| Watch saturation | Alert on CPU, heap, disk, FD, and pool utilization—not only HTTP 5xx after the fact. |
- Inventory CPU-, memory-, disk-, and connection-heavy endpoints and assign explicit budgets.
- Align API quotas with [unrestricted resource consumption](/glossary/unrestricted-resource-consumption) guidance (size, rate, complexity).
- Add tests that attempt oversize uploads, slow connections, and costly queries and expect rejection.
- Separate temp volumes for [file upload](/glossary/file-upload-vulnerability) extracts; never share root disk without quotas.
- Tune connection and thread pool sizes with overload shedding rather than infinite queues.
- Correlate exhaustion incidents to specific techniques (ReDoS, bombs, Slowloris, query abuse).
- Fix [security misconfiguration](/glossary/security-misconfiguration) that leaves unbounded admin or debug tools exposed.
- Remember: resource exhaustion is the app-level how; DoS/DDoS name the broader availability why.
The practical takeaway
Resource exhaustion is application-level depletion of CPU, memory, disk, or connections until service fails. Cap sinks, isolate heavy work, and monitor saturation before users feel the outage.
If a feature can allocate without a budget, attackers will spend that budget for you—often with far less traffic than a classic network flood.
Related security terms
Unrestricted Resource Consumption
OWASP API framing for missing quotas that enable exhaustion and cost attacks.
Denial of Service (DoS)
The availability outcome when critical resources are driven to zero headroom.
Decompression Bomb
A common memory/disk exhaustion technique via decode amplification.
Slowloris
Exhausts concurrent connection/worker slots with slow incomplete requests.
Frequently asked questions
What is resource exhaustion in simple terms?
The app uses up something limited—CPU, RAM, disk, or open connections—until it cannot serve normal users reliably.
Is resource exhaustion the same as DDoS?
Not necessarily. DDoS often causes exhaustion from many sources. Exhaustion can also come from a few expensive requests, bugs, or misconfiguration.
How does this relate to unrestricted resource consumption?
[Unrestricted resource consumption](/glossary/unrestricted-resource-consumption) is the API risk of missing limits; resource exhaustion is the resulting (or analogous) failure mode across app resources.
Which resources get exhausted most often?
CPU (ReDoS, heavy queries), memory (large payloads/decodes), disk (logs, extracts), and connection/thread pools (Slowloris, connection leaks).
Can authenticated users cause it?
Yes. Higher quotas and trusted roles often make costly operations easier to abuse.
How do you prevent resource exhaustion?
Set hard limits and timeouts, isolate heavy work, monitor saturation metrics, and fail closed when budgets are exceeded.
Is a zip bomb resource exhaustion?
Yes—zip and decompression bombs are concrete techniques that exhaust disk/memory during expand; see those glossary entries for format details.
References
Explore authoritative guidance and frameworks related to resource exhaustion.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.