CWE-406 (对网络消息容量的控制不充分(网络放大攻击)) — Vulnerability Class 11

CWE-406 represents a critical architectural weakness where software fails to adequately monitor or restrict the volume of network traffic it transmits. This flaw typically enables attackers to exploit the system as an amplifier in distributed denial-of-service (DDoS) campaigns. By sending small, legitimate-looking requests, adversaries trick the vulnerable application into generating disproportionately large responses to third-party targets, thereby exhausting network bandwidth and resources. Developers mitigate this risk by implementing strict rate-limiting policies and asymmetric resource controls that distinguish between normal user activity and potential amplification attacks. Enforcing quotas on outbound traffic per user or session ensures that no single actor can trigger excessive data transmission. Additionally, integrating robust monitoring systems allows for real-time detection of anomalous traffic patterns, enabling immediate throttling or blocking before the infrastructure suffers significant degradation or outage.