Hash flooding

Hash flooding

Hash flooding (also known as HashDoS) is a denial of service attack that uses hash collisions to exploit the worst-case (linear probe) runtime of hash table lookups. It was originally described in 2003 as an example of an algorithmic complexity attack. To execute such an attack, the attacker sends the server multiple pieces of data that hash to the same value and then tries to get the server to perform slow lookups. As the main focus of hash functions used in hash tables was speed instead of security, most major programming languages were affected, with new vulnerabilities of this class still showing up a decade after the original presentation.