Collected research
Crashing servers with digits
Crashing servers with digits: floating-point numbers DoS vulnerabilities
Submitting a number with millions of digits after the decimal point, or the same compactly in exponent notation, makes a server spend tens of seconds parsing a single request, so a handful of requests exhaust CPU and take the application down. Typically reachable through JSON money fields that accept unbounded decimal precision.
Record
- Document
- Crashing servers with digits: floating-point numbers DoS vulnerabilities
- Researcher
- Martin Matyja
- Published by
- securitum.com
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Martin Matyja, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .