DoS via WAF body size — exhausting the inspection budget on Cloudflare/Akamai

Quick answer

When a WAF receives a body larger than it can inspect, it has two options: fail-open (pass it without inspection, the juicy case) or fail-closed (block it). But there's a third, far less documented behavior: if the attacker can force the server's response to land in the cache with a malicious payload reflected in a cookie, you turn the oversize bypass into a persistent per-victim DoS — every future request from the victim carries the cookie payload, the WAF blocks it, and the app is inaccessible to them for the cookie's TTL (1 day to 1 month). Combined with XSS for remote delivery → mass DoS + selective targeting.

---

1. The core concept

Setup: a WAF (Cloudflare/Akamai/AWS) protects a site. The WAF has an inspection limit:

If the body exceeds that limit and the WAF is configured with fail-open (default in Cloudflare/AWS WAF) → the inspection is skipped, the origin receives the full request.

This, on its own, is already a bypass for classic SQLi/XSS. The DoS-via-WAF twist: if the payload is reflected in a cookie that the app returns in the Set-Cookie, the user's future requests carry that cookie and the WAF does inspect them (Headers/Cookies typically have another limit, usually lower). Once a malicious cookie is detected → the WAF blocks → the app is inaccessible.

---

2. The attack's components

Real-world: parameters like tracking_id, last_search, marketing_source, user_preference that the app stores in a persistent cookie for analytics or personalization.

---