Network Denial of Service (DDoS)

A network Denial-of-Service vulnerability lets an attacker make a service unreachable by sending traffic that costs the target far more to handle than it costs the attacker to send. Where RCE compromises confidentiality and integrity, DDoS compromises availability — the third leg of the security triad, and the one most visible to end users when something goes wrong.

Why it matters

Availability incidents tend to be public the moment they happen. They also have a cascading character: an outage on a single dependency (an authentication service, a DNS resolver, a TLS terminator) can take dozens of downstream services offline. Network-reachable resource exhaustion bugs sit upstream of those cascades. They are also the most attractive target for hacktivist and extortion-style attackers, who do not need to exfiltrate anything — just keep the service down.

How we identify DDoS on this site

The DDoS badge on a CVE page is deterministic. We emit it when all three of the following are true:

CVSS attack vector is Network (AV:N) — the bug can be triggered remotely; and
Availability impact is HIGH (A:H); and
The CVE is mapped to a CWE in the resource-exhaustion family: CWE-400 (Uncontrolled Resource Consumption), CWE-405 (Asymmetric Resource Consumption / amplification), CWE-407 (Algorithmic Complexity), CWE-674 (Uncontrolled Recursion), CWE-770 (Allocation of Resources Without Limits), CWE-834 (Excessive Iteration), or CWE-835 (Loop with Unreachable Exit Condition).

Requiring all three signals to agree keeps the badge meaningful. CVEs can carry both an RCE and a DDoS badge — that is correct when an attacker can either run code or just exhaust the service (Log4Shell is the canonical example).

What to do when you see the badge

Patch is always the right answer where available. Until it lands, the relevant compensating controls are usually upstream: rate-limiting, request validation, and edge filtering. The CVE page links to the NIST 800-53 r5 controls most relevant to defending against resource-exhaustion attacks.