3 ms·

As the site appears down: http://webcache.googleusercontent.com/search?q=cache:D8sBZ4-aAVYJ:cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-a

As the site appears down: http://webcache.googleusercontent.com/search?q=cache:D8sBZ4-aAVYJ:cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/+hashdos&cd=1&hl=en&ct=clnk&gl=uk http://webcache.googleusercontent.com/search?q=cache:D8sBZ4-... You mean to say, that if you've configured PHP in a poor way, (max post size, max execution time not appropriately tuned ) then you are open to a DoS? -- If you've configured it that badly, then this is probably the least of your worries.

thaumaturgy 15y ago
"Configure it badly" is simplistic. If you have a webmail application, how do you allow your users to upload reasonable email attachments (say 10MB for most providers) while not exposing yourself to this particular problem? The max_input_vars parameter was a new one for me.
DasIch 15y ago
The issue is not limited to PHP. Node.js/V8, CPython, Java, CRuby 1.8 and quite a lot of other implementations have this problem. Furthermore this is a problem you will encounter in every case in which the keys you populate a hash table with come from an untrusted source.