# Unbounded per-client state exhaustion

Per-client caches, pools or cookie jars with no fair cap or a defeatable eviction key

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 3 confirmed bounties, median $497, range $480-$1,500; latest 2024-09-22. Updated 2026-11-02._

## How it works
A component keeps per-client state — a session cache, a connection pool, a cookie jar — and assumes it is bounded because a limit or eviction path exists. The assumption breaks in three ways: the eviction key is mutated after insertion so removal never matches, the cap is a fixed slot count with no fairness or rate limit, or no cap exists at all. Attacker-controlled input then accumulates until the limit is hit or memory is exhausted, and legitimate clients are locked out [E1](https://bugbountylibrary.com/r/h1%3A2622671.md)[E2](https://bugbountylibrary.com/r/h1%3A1695472.md)[E3](https://bugbountylibrary.com/r/h1%3A1614328.md).

## Where it shows up
- Cache eviction that checks a field (e.g. `session_id_length`) at removal time that can be zeroed after insertion [E1](https://bugbountylibrary.com/r/h1%3A2622671.md)
- Fixed concurrent-connection caps on unauthenticated public ports with no rate limit or fair allocation [E2](https://bugbountylibrary.com/r/h1%3A1695472.md)
- Client-side storage of unbounded `Set-Cookie` headers with no count or outgoing-header size cap [E3](https://bugbountylibrary.com/r/h1%3A1614328.md)

## How to review
Identify every per-client store and its eviction or cap path. The invariant: **every entry inserted must be removable by the same key used at insertion, and the cap must be enforced by fair allocation, not just a slot count.** Check that the eviction predicate cannot be defeated by later mutation of the key field [E1](https://bugbountylibrary.com/r/h1%3A2622671.md); that public unauthenticated endpoints rate-limit and fairly share slots [E2](https://bugbountylibrary.com/r/h1%3A1695472.md); and that client-side accumulators (cookies, headers) have explicit count and size caps before they feed a hard limit [E3](https://bugbountylibrary.com/r/h1%3A1614328.md).

## How finders spotted it
- Observed cache size exceeding the configured limit after minutes of continuous connections, then traced the eviction path and found the tail had `session_id_length` zeroed, defeating the deletion check [E1](https://bugbountylibrary.com/r/h1%3A2622671.md)
- Noted the node enforces a fixed 500-connection limit on a public read port and reasoned that since reads are unauthenticated, an allowlist cannot protect it; confirmed by saturating with padded, throttled requests [E2](https://bugbountylibrary.com/r/h1%3A1695472.md)
- Reasoned about curl's internal 1MB request-size threshold and realized unbounded cookie storage could push outgoing requests past it; checked cookie domain-matching to extend impact to siblings [E3](https://bugbountylibrary.com/r/h1%3A1614328.md)

## Variants seen
- Server-side session cache with a broken eviction predicate [E1](https://bugbountylibrary.com/r/h1%3A2622671.md)
- Connection-pool exhaustion on a public unauthenticated port [E2](https://bugbountylibrary.com/r/h1%3A1695472.md)
- Client-side cookie accumulation past a hard request-size cap [E3](https://bugbountylibrary.com/r/h1%3A1614328.md)

## Impact and severity
Denial of service: unreachable ledger for all clients [E2](https://bugbountylibrary.com/r/h1%3A1695472.md), persistent DoS for sibling subdomains [E3](https://bugbountylibrary.com/r/h1%3A1614328.md), unbounded memory growth [E1](https://bugbountylibrary.com/r/h1%3A2622671.md). Impact rises with cross-subdomain reach via cookie domain-matching, where one sister server can DoS a sibling on the same second-level domain [E3](https://bugbountylibrary.com/r/h1%3A1614328.md), and with scaling from one VM to many for DDoS [E2](https://bugbountylibrary.com/r/h1%3A1695472.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **curl**: CVE-2022-32205: Set-Cookie denial of service (CVE-2022-32205). Report: https://bugbountylibrary.com/r/h1%3A1614328.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2622671.md
- E2: https://bugbountylibrary.com/r/h1%3A1695472.md
- E3: https://bugbountylibrary.com/r/h1%3A1614328.md