If the client handles XML you can use a "billion laughs attack" https://en.wikipedia.org/wiki/Billion_laughs_attack https://en.wikipedia.org/wiki/Billion_laugh

If the client handles XML you can use a "billion laughs attack" https://en.wikipedia.org/wiki/Billion_laughs_attack https://en.wikipedia.org/wiki/Billion_laughs_attack Also, see if they crash with invalid responses. You can serve a malformed document or something like that.