Serialization 14 📄 Denial-of-Service via Deserialization — Size Limits and Resource Exhaustion
Deserialization does not need to execute code to be dangerous. A payload that is small on the wire can expand into a structure that exhausts memory, blocks the event loop, or crashes the process. The attack class is CWE-400, uncontrolled resource consumption, and it appears in every format and every language: YAML’s billion laughs, JSON’s deeply nested arrays, .NET’s object graphs, and Apache CXF’s unbounded attachment headers . The mitigation is the same in principle—bound what the deserializer is allowed to allocate—but the limits must be placed at the layer that sees the expansion before it happens.
This chapter covers the resource-exhaustion attacks that target deserializers, the size and depth limits that mitigate them, and the fail-closed patterns that prevent a rejected payload from reaching a consumer that would materialize it. The sections that follow walk through the expansion mechanisms, the limit taxonomy, and the placement rules that determine whether a limit actually protects the system.
Key point: A deserialization DoS succeeds when the parser or a downstream consumer allocates more than the input’s size suggests; mitigate with input size caps, graph depth limits, element count limits, and expansion ratios, placed before the allocation happens and enforced fail-closed.
a. The expansion mechanisms
Resource exhaustion through deserialization takes four forms, each exploiting a different property of the parser or the data model.
Alias expansion is YAML’s billion laughs. A small document defines anchors on collections and aliases them repeatedly, nesting the aliases so the resolved structure grows exponentially. Symfony’s advisory describes the mechanism precisely: aliases referencing collections can themselves point to collections containing aliases, and “a small input can blow up into a multi-gigabyte structure and exhaust memory” . The parser resolves the aliases; the expansion is a data-structure operation, not a code-execution operation.
Nesting depth exhausts the stack rather than the heap. A JSON document with thousands of nested arrays or objects causes the parser’s recursive descent to overflow the call stack, crashing the process. The Apache Struts JSON plugin added a maxDepth of 64 specifically for this reason . The L4YAML threat model lists “deeply nested structures” alongside billion laughs as a DoS category .
Element count exhausts memory linearly. A JSON array with ten million elements, or a message with an unbounded number of attachment headers, causes the parser to allocate proportional to the count. Apache CXF’s CVE-2026-50645 is exactly this: no restriction on the number of attachment headers a message can contain, leading to uncontrolled memory consumption . The fix imposed a default maximum of 500 attachments per message.
String size exhausts memory with a single value. A JSON string field of a gigabyte, or a YAML scalar of similar size, forces the parser to allocate the full string before any downstream validation runs. The Struts JSON plugin’s maxStringLength default of 256KB and maxLength of 2MB are the bounds that prevent this .
b. The limit taxonomy and default values
The limits fall into four families, and a production deserializer should have all of them configured.
| Limit | Protects Against | Example Default |
|---|---|---|
| Input size | Oversized payloads | 2 MB (Struts) |
| Nesting depth | Stack overflow | 64 (Struts) |
| Element count | Linear memory growth | 10,000 (Struts) |
| Expansion ratio | Alias/decompression bombs | 50–1000 |
The defaults are starting points, not universal answers. A configuration file parser can tolerate a 10 MB input; an API endpoint that accepts user JSON should cap at 2 MB or less. A YAML parser for trusted deployment manifests can allow aliases; a parser for user-uploaded YAML should reject them or limit collection alias resolutions to 128, following the SnakeYAML model that Symfony adopted .
The expansion ratio is the limit that catches bombs that pass the size and count checks. safezip uses max_per_member_ratio and max_total_ratio defaults of 50.0 for ZIP bombs, aborting extraction before runaway decompression exhausts disk or memory . The principle applies to any format where the output can be larger than the input: measure the expansion, not just the input.
c. Placement and fail-closed enforcement
A limit that runs after the allocation has already happened does not prevent the allocation. The placement rules are mechanical.
Cap input size before parsing. Read the byte stream, check its length against the cap, and reject before handing it to the deserializer. This is the only limit that can run before the parser allocates anything.
Set depth and element limits in the parser configuration. The Struts JSON plugin exposes maxElements, maxDepth, maxLength, maxStringLength, and maxKeyLength as configurable options . A parser without these options should not be used for untrusted input, or should be wrapped in a layer that enforces them.
Fail closed on breach. A rejected payload must not be partially parsed, cached, or passed to a consumer. The Apache CXF fix imposes a hard maximum of 500 attachments; a message exceeding it is rejected, not truncated . The Symfony fix counts collection alias resolutions and throws when the limit is exceeded . The error is the outcome; there is no partial success.
Bound the consumer, not just the parser. A parser that returns a DAG of shared references has not allocated the expanded structure. A downstream str(), deepcopy(), or serialization will. The guard must either reject the document at parse time or ensure that no consumer can materialize the expansion. The OpenAPI.NET fix added a conversion budget of 5,000,000 materialized nodes and a depth of 64, throwing a diagnostic error instead of allowing OOM .
Complete Example Session
# ============================================
# PART 1: THE EXPANSION ATTACK
# ============================================
# A small YAML document with nested aliases
a: &a ["x","x","x","x","x","x","x","x","x"]
b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
# The document is ~200 bytes.
# The resolved structure is megabytes at depth 4,
# gigabytes at depth 8.
# ============================================
# PART 2: THE LIMIT CONFIGURATION
# ============================================
# Symfony: limit collection alias resolutions
# new Parser(maxAliasesForCollections: 128)
# or reject all aliases:
# Yaml::parse($input, Yaml::PARSE_EXCEPTION_ON_ALIAS)
# Struts JSON plugin:
# struts.json.maxElements=10000
# struts.json.maxDepth=64
# struts.json.maxLength=2097152
# struts.json.maxStringLength=262144
# ============================================
# PART 3: THE FAIL-CLOSED PATTERN
# ============================================
# try: data = parse(untrusted)
# except ResourceLimitError: return None
# The error is the result. No partial document.
# ============================================
# PART 4: THE CONSUMER BOUND
# ============================================
# If the parser returns a DAG, bound the materialization:
# - Max materialized nodes: 5,000,000
# - Max depth: 64
# Throw instead of OOM.The parts covered the expansion attack, the limit configuration, the fail-closed pattern, and the consumer bound.
Quick Reference
Attack Categories
| Category | Mechanism | Example |
|---|---|---|
| Alias expansion | Nested anchors multiply structure | YAML billion laughs |
| Nesting depth | Stack overflow | Deeply nested JSON |
| Element count | Linear memory growth | CXF attachment headers |
| String size | Single large allocation | Oversized JSON string |
Limit Defaults
| Limit | Struts JSON | Symfony YAML | safezip |
|---|---|---|---|
| Max input | 2 MB | — | — |
| Max depth | 64 | — | — |
| Max elements | 10,000 | — | 10,000 |
| Max string | 256 KB | — | — |
| Alias/ratio | — | 128 collections | 50.0 ratio |
Placement Rules
| Rule | Detail |
|---|---|
| Input cap | Before parsing |
| Parser limits | In deserializer config |
| Expansion budget | Before consumer materializes |
| Fail closed | Error, not partial data |
Best Practices
✅ Do This:
# Cap input before parsing
if len(payload) > 2_000_000: return None # ✅
# Configure parser limits
# struts.json.maxDepth=64
# struts.json.maxElements=10000 # ✅
# Reject aliases for untrusted YAML
Yaml::parse($input, Yaml::PARSE_EXCEPTION_ON_ALIAS); # ✅
# Bound consumer materialization
if node_count > 5_000_000: raise DiagnosticError # ✅❌ Don’t Do This:
# Trust a small payload
# (a 200-byte bomb expands to gigabytes) # ❌
# Parse without depth or element limits
json.loads(untrusted) # no bounds # ❌
# Let a DAG reach str() or deepcopy
str(yaml.safe_load(bomb)) # hangs # ❌
# Truncate instead of reject
# (partial data is worse than no data) # ❌Common Pitfalls
| Pitfall | Why It Happens | Fix |
|---|---|---|
| Safe parser still OOMs | Alias expansion not bounded | Collection alias limit |
| Consumer hangs after parse | DAG materialized downstream | Guard at parse, before consumer |
| Element count bypassed | Nested structures not counted | Count total nodes, not top-level |
| Legitimate data rejected | Limit too low | Scale limits to use case |
| Filter only checks class names | No size/depth bounds | Add resource limits |
Real-World Examples
1. Symfony YAML alias limit
new Parser(maxAliasesForCollections: 128);2. Symfony alias rejection
Yaml::parse($input, Yaml::PARSE_EXCEPTION_ON_ALIAS);3. Struts JSON depth limit
struts.json.maxDepth=644. CXF attachment limit
Max 500 attachments per message5. safezip ratio limit
max_total_ratio=50.06. OpenAPI.NET node budget
MaxNodeCount = 5_000_000; MaxDepth = 64;7. Input size cap
if len(data) > MAX_BYTES: raise ValueError8. Fail-closed error
except ResourceLimitError: return None9. DAG guard placement
Reject at parse, before str() or deepcopy10. L4YAML strict preset
parseYamlSafe input .strict // untrusted inputVisual
The Expansion Problem
┌─────────────────────────────────────────────────────────┐
│ SMALL INPUT LARGE STRUCTURE │
│ │
│ a: &a [9 items] 9 nodes │
│ b: &b [9 × *a] 81 nodes │
│ c: &c [9 × *b] 729 nodes │
│ d: &d [9 × *c] 6,561 nodes │
│ │
│ ~200 bytes → megabytes at depth 8 │
│ The parser resolves; the consumer explodes │
└─────────────────────────────────────────────────────────┘Limit Placement
┌─────────────────────────────────────────────────────────┐
│ LAYER 1: INPUT SIZE CAP │
│ Before parsing │
│ │ │
│ ▼ │
│ LAYER 2: PARSER LIMITS │
│ Depth, elements, string size │
│ │ │
│ ▼ │
│ LAYER 3: EXPANSION BUDGET │
│ Alias count, materialized nodes │
│ │ │
│ ▼ │
│ CONSUMER │
│ Only receives bounded data │
└─────────────────────────────────────────────────────────┘Fail-Closed Flow
┌─────────────────────────────────────────────────────────┐
│ LIMIT EXCEEDED │
│ │ │
│ ▼ │
│ Raise ResourceLimitError │
│ │ │
│ ▼ │
│ Caller returns error / None / 400 │
│ │ │
│ ▼ │
│ No partial document, no cached DAG, no retry │
└─────────────────────────────────────────────────────────┘The DAG Trap
┌─────────────────────────────────────────────────────────┐
│ PARSER RETURNS DAG │
│ (small memory, shared references) │
│ │ │
│ ▼ │
│ CONSUMER CALLS str() OR deepcopy() │
│ │ │
│ ▼ │
│ EXPANSION HAPPENS │
│ (memory explodes) │
│ │
│ Guard must be before the consumer, not after │
└─────────────────────────────────────────────────────────┘Summary
| Item | Value |
|---|---|
| Attack class | CWE-400 (uncontrolled resource consumption) |
| Alias bomb | YAML nested anchors |
| Depth bomb | Stack overflow from nesting |
| Count bomb | Unbounded elements (CXF attachments) |
| String bomb | Single large allocation |
| Input cap | 2 MB (Struts) |
| Depth limit | 64 (Struts) |
| Alias limit | 128 collections (Symfony) |
| Fail-closed | Error, not partial data |
Key takeaways:
- Deserialization DoS does not need code execution. A small payload that expands into a large structure exhausts memory or stack without a single gadget chain. The attack class is CWE-400, and it appears in every format .
- Alias expansion is the YAML-specific bomb. Nested anchors and aliases multiply the resolved structure exponentially. Symfony’s fix counts collection alias resolutions and limits them to 128, following the SnakeYAML model .
- Depth and element limits are the JSON and generic defenses. The Struts JSON plugin exposes
maxDepth(64),maxElements(10,000), andmaxStringLength(256KB) as configurable bounds . A parser without these options is not safe for untrusted input. - The guard must be before the allocation, not after. A parser that returns a DAG of shared references has not allocated the expansion. The consumer that calls
str()ordeepcopy()will. Bound the consumer or reject at parse time . - Fail closed. A rejected payload must not be partially parsed, cached, or retried. The error is the outcome, and the caller must treat it as such.
Remember: Resource exhaustion is deserialization’s quiet attack. It does not need a gadget chain or a vulnerable class; it needs a parser that trusts the input’s size and a consumer that materializes what the parser returns. Cap the input before parsing, set depth and element limits in the deserializer, bound alias expansion or reject aliases entirely, and fail closed when a limit is breached. The bomb is small; the explosion is deferred; the limit must run before the deferral becomes memory.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!