# Unbounded parser resource exhaustion

Per-item limits but no aggregate cap on count, size, overlap, or eviction

_Area: Web infrastructure and server-side requests. Seen in 7 disclosed reports; 6 confirmed bounties, median $1,449, range $150-$5,420; latest 2026-06-02. Updated 2026-10-23._

## How it works
A parser accepts an attacker-controlled count or size and allocates resources per item without a hard cap. The assumption that breaks is that input volume is bounded by request size or by per-item limits. Per-item checks (each range within file size, each header under limit, each part valid) do not bound the total, so a small request amplifies into large memory or response growth [E2](https://bugbountylibrary.com/r/h1%3A2520679.md)[E5](https://bugbountylibrary.com/r/h1%3A2334401.md)[E7](https://bugbountylibrary.com/r/h1%3A1904097.md). A related shape: a cache or store admits attacker-controlled entries but its eviction path cannot remove them, so accumulation is unbounded [E6](https://bugbountylibrary.com/r/h1%3A2622671.md).

## Where it shows up
- Range/partial-content handlers that cap each range but not the number or overlap of ranges [E2](https://bugbountylibrary.com/r/h1%3A2520679.md)
- HTTP/2 header buffering where the stream reset happens only after all CONTINUATION frames are processed [E5](https://bugbountylibrary.com/r/h1%3A2334401.md)
- HPACK indexed references to near-empty headers, plus zero-window stalls pinning allocations [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-codex-discovered-a-hidden-http2-bomb.md)
- Image decoders run on declared dimensions without a pre-decode guard, especially on a second upload path [E4](https://bugbountylibrary.com/r/h1%3A1620170.md)
- Multipart parsers opening a temp file per part with no cap on part count [E7](https://bugbountylibrary.com/r/h1%3A1904097.md)
- Caches whose eviction key is mutated after insertion, silently disabling eviction [E6](https://bugbountylibrary.com/r/h1%3A2622671.md)
- Clients storing unlimited Set-Cookie headers that accumulate into a later request-size cap [E8](https://bugbountylibrary.com/r/h1%3A1614328.md)
- Adjacent: proxies with no read timeout or size cap on chunked responses lacking Content-Length [E3](https://bugbountylibrary.com/r/h1%3A507525.md)

## How to review
Identify every attacker-controlled count or size and trace the per-item allocation. The invariant: total resources consumed must be bounded by a constant, not by input item count. Name the aggregate counter (number of ranges, frames, parts, cookies, cache entries) and check it is capped. Compute the amplification ratio (response or allocation bytes / request bytes) and confirm it is bounded. Check that timeouts bound slow or trickled input, and that eviction keys are stable between insert and remove. Diff parallel code paths for missing guards [E4](https://bugbountylibrary.com/r/h1%3A1620170.md).

## Variants seen
- Multi-range response amplification from a tiny file [E2](https://bugbountylibrary.com/r/h1%3A2520679.md)
- Header buffering before stream reset [E5](https://bugbountylibrary.com/r/h1%3A2334401.md)
- HPACK indexed-reference bomb with flow-control stall; per-entry bookkeeping, not decoded-size cap, is the unbounded axis [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-codex-discovered-a-hidden-http2-bomb.md)
- Missing dimension guard on alternate upload path [E4](https://bugbountylibrary.com/r/h1%3A1620170.md)
- Unbounded temp-file-per-part in multipart parsing [E7](https://bugbountylibrary.com/r/h1%3A1904097.md)
- Broken cache eviction invariant [E6](https://bugbountylibrary.com/r/h1%3A2622671.md)
- Unbounded cookie accumulation into a request-size cap [E8](https://bugbountylibrary.com/r/h1%3A1614328.md)
- Chunked-response and timeout gaps in a proxy [E3](https://bugbountylibrary.com/r/h1%3A507525.md)

## Why fixes fail
Guards applied on one path but not a parallel one [E4](https://bugbountylibrary.com/r/h1%3A1620170.md), and per-item limits mistaken for aggregate limits [E2](https://bugbountylibrary.com/r/h1%3A2520679.md), leave the class open. Testable check: send N items each individually valid and confirm total allocation stays flat as N grows.

## Impact and severity
Led to OOM crashes and full availability loss [E5](https://bugbountylibrary.com/r/h1%3A2334401.md)[E7](https://bugbountylibrary.com/r/h1%3A1904097.md), persistent DoS [E6](https://bugbountylibrary.com/r/h1%3A2622671.md)[E8](https://bugbountylibrary.com/r/h1%3A1614328.md), and response amplification [E2](https://bugbountylibrary.com/r/h1%3A2520679.md). Severity rises with amplification ratio and shared infrastructure; a single request crashing a server is critical.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-codex-discovered-a-hidden-http2-bomb.md
- E2: https://bugbountylibrary.com/r/h1%3A2520679.md
- E3: https://bugbountylibrary.com/r/h1%3A507525.md
- E4: https://bugbountylibrary.com/r/h1%3A1620170.md
- E5: https://bugbountylibrary.com/r/h1%3A2334401.md
- E6: https://bugbountylibrary.com/r/h1%3A2622671.md
- E7: https://bugbountylibrary.com/r/h1%3A1904097.md
- E8: https://bugbountylibrary.com/r/h1%3A1614328.md