---
type: Article
title: "Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies"
description: A client keeps an HTTP/1.1 chunked JSON body syntactically open while sending one byte per second, tying up framework body readers that lack effective request-body timeouts. Tests across 41 framework and infrastructure targets report that 90% are vulnerable under default configuration.
resource: "https://cr0hn.com/en/papers/slow-json-stream/"
tags: [article, webseclist-reference, en, daniel-alfocea, dos, http, rest-api, measurement-study]
generated:
  by: webseclist-refs/1
  at: "2026-10-02T00:14:40+00:00"
status: stable
stale_after: 2027-10-02
sources:
  - id: original
    resource: "https://cr0hn.com/en/papers/slow-json-stream/"
    title: "Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies"
    author: Daniel Alfocea, @ggdaniel
    last_modified: 2026-06-24
  - id: canonical
    resource: "https://danielalfocea.com/en/papers/slow-json-stream/"
also_at: []
authors:
  - Daniel Alfocea
  - "@ggdaniel"
canonical_url: "https://danielalfocea.com/en/papers/slow-json-stream/"
cited_by:
  - "2026-ai.md:31"
commit: ""
content_sha256: de5cb0fd7bc67cc698d1efa074a883871f548899b32dbbd73f5aff259bcc2695
depth: full
depth_reason: default
kind: article
language: en
licence: unknown
original_url: "https://cr0hn.com/en/papers/slow-json-stream/"
published: 2026-06-24
publisher: Daniel Alfocea
publisher_english: ""
raw_sha256: 0e599453d0280e031b9a0307f1497d3adabda746e96ba6f079215115760b4d88
retrieved_from: "https://danielalfocea.com/en/papers/slow-json-stream/"
retrieved_kind: live
retrieved_utc: "2026-10-02T00:14:40+00:00"
slug: 2026-daniel-alfocea-slow-json-stream-low-bandwidth-denial-service-attack-bodies
snapshot: ""
title_english: ""
translation_file: ""
translation_of: ""
---

# Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies

**Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies** - Daniel Alfocea, @ggdaniel, Daniel Alfocea.

- Published: 2026-06-24
- Original: <https://cr0hn.com/en/papers/slow-json-stream/>
- Current location: <https://danielalfocea.com/en/papers/slow-json-stream/>
- Preserved from: https://danielalfocea.com/en/papers/slow-json-stream/ (live) on 2026-10-02
- Licence: unknown

Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so
it remains readable if the page goes offline. To read the original, follow the link above.

## Content

> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.

Abstract

Low-bandwidth DoS attack against HTTP APIs that accept JSON bodies. The attacker opens an HTTP/1.1 chunked connection and drips a valid JSON prefix at one byte per second, never sending the closing token. 90% of 41 evaluated targets are vulnerable under default configuration.

Slow JSON Stream is a low-bandwidth denial-of-service attack against HTTP APIs that accept `application/json` bodies.

## How it works

The attacker opens an HTTP/1.1 connection with chunked Transfer-Encoding and drips a valid JSON prefix (e.g. `{"items":[{...,}`) at one byte per second, never sending the closing token. Slowloris does the same with HTTP headers and servers already cut it with `client_header_timeout`. This variant reaches the framework body reader and JSON parser, where most frameworks have no body timeout set by default.

## Results

I evaluated 32 framework/runtime combinations and 9 infrastructure targets (proxies, WAFs, API gateways). 90% of the 41 targets are vulnerable under default configuration.

- Tier 1 (exploitable at 64 connections): 6 targets, 5 frameworks plus Kong CE API Gateway
- Tier 2 (no effective body timeout, connections accumulate indefinitely): 29 targets
- Tier 3 (100% error rate under 64 connections): Flask sync and Rails
- Tier 4 (resistant by default): 4 targets

The data, tools and Docker testbed are publicly available for exact replication.

Status: pending approval for publication.

[View the code](https://github.com/cr0hn/slowjson)