Collected research

CPDoS: Cache Poisoned Denial of Service

Cache Poisoned Denial of Service

Hoai Viet Nguyen, Luigi Lo Iacono and Hannes Federrath · cpdos.org

CPDoS poisons a cache with an error page instead of content: a single request carrying an oversized header, a meta character or a method-override header passes the cache but makes the origin fail. The cache stores the error response and serves it to every later visitor, disabling the resource across a CDN region.

Record

Document

Cache Poisoned Denial of Service

Researcher

Hoai Viet Nguyen, Luigi Lo Iacono and Hannes Federrath

Published by

cpdos.org

Topic

HTTP

In the archive

• Collected in the 2019 research round

Related sources

• Full paper Whitepaper
• CPDoS HHO demonstration
• CPDoS HMO demonstration

Tags

• cache-poisoning
• dos
• cache
• http
• cdn
• header-injection
• proxy
• measurement-study
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Hoai Viet Nguyen, Luigi Lo Iacono and Hannes Federrath, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.