CWE-405 (不对称的资源消耗(放大攻击)) — Vulnerability Class 33

CWE-405 represents an asymmetric resource consumption weakness where an attacker triggers disproportionate system resource usage without expending equivalent computational effort. This vulnerability is typically exploited through amplification attacks, such as reflection or protocol-based exploits, where a small input causes the system to generate a massive volume of responses or processing tasks. The resulting non-linear resource spike often leads to denial-of-service conditions, degrading performance for legitimate users or causing complete system crashes. To mitigate this risk, developers must implement strict rate limiting, enforce request quotas, and validate input complexity before processing. Additionally, employing resource caps, timeout mechanisms, and efficient algorithmic designs ensures that external inputs cannot disproportionately impact system stability, thereby maintaining availability and preventing attackers from leveraging asymmetry for disruptive effects.