Isolated Laboratory Verification of Resource Exhaustion and Complexity Bounds
A request asks the server to process ten million nested items at once, freezing memory and processor capacity for everyone else. Because load testing can slow down a live system, this check is disabled in automatic scans and runs only in isolated lab mode, where the wire filter caps size and compiles a strict quota rule.
Resource exhaustion vulnerabilities arise when an endpoint accepts unbounded array lengths, deep object nesting, or catastrophic regular expression inputs without enforcing upper limits prior to allocation. A single crafted payload can saturate worker threads or exhaust container memory.
1. Interception and Rule Synthesis Schematic for DOS-RSRC
Verification sequence for DOS-RSRC: candidate probe inspection by wire rule SEC-ZD-DOS-01, differential confirmation via witness cf88675b91a40e12, and compilation of gateway contract IMMUNE-DOS-CF88675B.
2. In-Path Mutation Blocking and Paired Decoy Verification (DOS-RSRC)
Because active load generation carries an inherent risk of degrading live services, class DOS-RSRC is separated from the seven active auto-scan classes into an explicit laboratory mode (LAB_ONLY). In standard automated runs it remains disabled; when invoked on an isolated lab stand, rule SEC-ZD-DOS-01 intercepts unbounded allocations before socket delivery.
In laboratory verification, the sandbox proves the missing bound by inspecting parameter cardinality and nesting depth against deterministic thresholds, recording the interception event in the Streebog-256 ledger without starving the target process.
Class Identifier: DOS-RSRC (dos_resource)
Execution Mode: Isolated Laboratory Mode (LAB_ONLY)
Candidate Probe: POST /api/v1/lab/dos/render {"items": 10000000, "depth": 512}
Blocked Mutation: Unbounded allocation > 64 MB; recursion depth > 32
Stand Confusion Matrix: Lab Guarded via SEC-ZD-DOS-01
Wire Sandbox Rule: SEC-ZD-DOS-01
Formal Witness Hash: cf88675b91a40e12
Compiled Sentinel Rule: IMMUNE-DOS-CF88675B (synthesis time 15 µs)3. Automatic Synthesis of Gateway Rule IMMUNE-DOS-CF88675B
The compiler synthesizes contract IMMUNE-DOS-CF88675B, which enforces hard ceilings on payload byte size, array length, and recursion depth inside mcp-sentinel before the request reaches the application handler.
4. Related Benchmark Classes on the INDRA Stand
INJ-SQL: Database Query InjectionINJ-CMD: Operating System Command InjectionDIR-TRV: Filesystem Path TraversalAUTH-BOLA: Broken Object Level AuthorizationSSRF-INT: Server-Side Request Forgery and Redirect BypassSEC-LEAK: Authentication Token and Secret ExposureHDR-SEC: Missing Transport and Framing Security Headers