decompression-dos

To prevent zip bomb attacks on file upload services, you must enforce decompression ratio caps and length-field allocation bounds on archive parsing. Auditing input paths for missing decompression limits stops small valid archives from exhausting server resources.

An amplification denial-of-service attack uses tiny structurally valid inputs, like billion-laughs XML or ReDoS strings, to exhaust server resources. These attacks bypass standard WAF and autoscaling defenses by exploiting unbounded processing in input validation logic.

Auditing for ReDoS vulnerabilities involves checking regex matching against user-supplied data for linear-time enforcement and parse depth limits. A security audit identifies missing bounds for regex complexity across all public-facing input processing paths.

Blocking Zip Slip path traversal requires Zip Slip path confinement controls to meet modern security and compliance standards. Mapping identified input validation gaps to NIST 800-53, NIS2, or UK CAF demonstrates where existing controls are outdated for archive uploads.

You can disable XML entity expansion to stop billion-laughs attacks by ensuring your structured data parsing includes strict entity bounds. Analyzing XML parsing logic verifies that missing expansion limits are flagged before user-supplied data causes resource exhaustion.

Traditional input validation fails DoS prevention when it lacks unbounded processing limits for decompression size, parse depth, and regex complexity. Standard defenses miss structurally valid malicious inputs that bypass autoscaling by consuming resources within single requests.