aegis-denial-of-service
Denial of Service & Resource Exhaustion (Application Layer)
Primary CWE mappings used throughout this module:
| CWE | Name | Used for |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | General missing-limits DoS findings |
| CWE-1333 | Inefficient Regular Expression Complexity | ReDoS findings |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | Zip/decompression bomb findings |
Secondary CWEs referenced inline where they fit better than the three above: CWE-405 (Asymmetric Resource Consumption / Amplification), CWE-407 (Inefficient Algorithmic Complexity), CWE-674 (Uncontrolled Recursion), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-776 (Improper Restriction of Recursive Entity References in DTDs, i.e. XML entity expansion), CWE-789 (Memory Allocation with Excessive Size Value). All of these are verified CWE identifiers; do not invent additional ones.
OWASP Top 10 2021 mapping: A05:2021 – Security Misconfiguration covers missing body-size limits, unsafe parser defaults, and absent timeouts. Findings rooted in algorithm/design choices (quadratic logic, unbounded GraphQL fanout) additionally map to A04:2021 – Insecure Design; state both when relevant.
Scope & Objectives
Audit the application layer only. You are looking for code and configuration that lets ONE small request — or a handful of requests — consume disproportionate CPU, memory, disk, connection slots, or money.
In scope: