Distributed Denial of Service (DDoS)

A Denial-of-Service vulnerability lets an attacker take a service offline by feeding it input that exhausts its resources — memory, CPU, file descriptors, network bandwidth, or processing time. When the attack reaches the service over a network and one or more attacker-controlled hosts are enough to bring the target down, defenders typically call it DDoS. Availability is the half of the CIA triad that the RCE and LPE badges don’t cover; DDoS does.

Why it matters

DDoS bugs are how a noisy outage becomes a strategic weapon. Attackers use them to mask other activity, to coerce ransom payment ("pay or stay offline"), to disrupt customer-facing services during peak periods, and to soften the perimeter before an intrusion. The amplification family (CWE-405) is also how protocol-level bugs get turned into reflection attacks against third parties. Edge devices — firewalls, VPN concentrators, load balancers — tend to concentrate the worst availability risk because losing them takes the whole service offline.

How we identify DDoS on this site

The DDoS badge on a CVE page is deterministic. We emit it when both of the following are true:

CVSS attack vector is Network (AV:N) — the attack reaches the target over a network — and at least one impact metric is HIGH; and
The CVE is mapped to a CWE in the denial-of-service family: CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation Without Limits), CWE-405 (Asymmetric Resource Consumption / amplification), CWE-834 (Excessive Iteration), CWE-674 (Uncontrolled Recursion), CWE-835 (Loop with Unreachable Exit), or CWE-407 (Algorithmic Complexity).

Requiring both signals to agree keeps the badge meaningful. A network-reachable bug that crashes a process without a resource-consumption CWE doesn’t qualify, and a resource-exhaustion bug exploitable only from a local prompt (AV:L) doesn’t qualify either. The same CVE can carry an RCE chip alongside DDoS when both classes of CWE apply — Log4Shell-style vulnerabilities are the canonical example.

What to do when you see the badge

For internet-exposed services, the first instinct should be rate-limiting and protocol-layer mitigation upstream of the vulnerable code path. Patching closes the underlying flaw; WAF / scrubbing rules, connection budgets, and request quotas buy time until patches roll. The Mitigating Controls section on the CVE page links to the NIST 800-53 r5 controls most relevant to availability defence.