Exhaustion Attack

CORE DEFINITION

A class of denial-of-service attack in which the adversary never compromises the target directly but instead drains a finite resource it depends on, including CPU cycles, memory, connection slots, disk space, or bandwidth. Because the resource is exhausted rather than corrupted, the system remains intact yet unresponsive to legitimate users. The defining qualification is that the attack targets a bottleneck, so defense requires identifying which resource is actually constrained. The same logic applies outside computing, where a rival can exhaust a competitor's cash or attention through endless litigation, price wars, or public relations campaigns rather than by beating its product.