CAPEC-528

XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. This attack exploits the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Survey the target] Using a browser or an automated tool, an attacker records all instance of web services to process XML requests.

      2 techniques

      • Use an automated tool to record all instances of URLs to process XML requests.
      • Use a browser to manually explore the website and analyze how the application processes XML requests.

2. Experiment

   They probe what they found.

   2. An adversary crafts input data that may have an adverse effect on the operation of the web service when the XML data sent to the service.

3. Exploit

   They carry out the attack.

   3. [Launch a resource depletion attack] The attacker delivers a large number of XML messages to the target URLs found in the explore phase at a sufficiently rapid rate. It causes denial of service to the target application.

      1 technique

      • Send a large number of crafted XML messages to the target URL.

Prerequisites

• The target must receive and process XML transactions.

• An adverssary must possess the ability to generate a large amount of XML based messages to send to the target service.

Skills required

• Low skill

  Denial of service

Signs of an attack

• A large amount of data is passed to the XML parser possibly making it crash or otherwise unavailable to end users.

Consequences

Mitigations

• Design: Build throttling mechanism into the resource allocation. Provide for a timeout mechanism for allocated resources whose transaction does not complete within a specified interval.

• Implementation: Provide for network flow control and traffic shaping to control access to the resources.

Weaknesses it exploits

• CWE-770 Allocation of Resources Without Limits or Throttling

Recent CVEs with these weaknesses

1. –CVE-2026-865312026-11-10

   The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive mem…

2. 7.0CVE-2026-1143592026-11-10

   Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an ar…

3. 8.7CVE-2026-600402026-11-10

   An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability.

4. 8.7CVE-2026-1238172026-11-09

   AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a fra…

5. 6.8CVE-2026-1252052026-11-09

   FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file …

6. 5.7CVE-2026-1251862026-11-09

   FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 pa…

7. 6.8CVE-2026-1251802026-11-09

   FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF…

8. 7.5CVE-2026-1123222026-11-09

   clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumptio…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-125 Flooding

More specific patterns

• CAPEC-147 XML Ping of the Death

Examples

MITRE's words, unchanged: CAPEC-528 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.