Which attack uses a grammatically correct SOAP document containing infinite processing loops to exhaust XML parser and CPU resources?

Which attack uses a grammatically correct SOAP document containing infinite processing loops to exhaust XML parser and CPU resources?

• A. Recursive Payloads
• B. Oversize Payloads
• C. SOAPAction
• D. Frame Injection

Answer: (A)

Resource exhaustion through recursive parsing of XML in SOAP messages explains this attack. SOAP is XML-based, and a carefully crafted, well-formed SOAP document can include self-referential or deeply nested structures that force the XML parser to recurse indefinitely or far beyond normal limits. As the parser keeps processing these recursive constructs, CPU and memory are consumed until the service slowdowns or crashes, achieving denial of service. This is what “recursive payloads” describe—the payload is designed to trigger endless or extremely deep parsing, not merely to be large or to manipulate headers. The other options don’t fit this scenario. Oversize payloads rely on sheer size to exhaust resources rather than inducing infinite processing loops. SOAPAction is just a SOAP header value and doesn’t inherently force recursive parsing. Frame Injection concerns embedding content to influence how web pages display or behave, not XML parsing inside SOAP. To guard against this, use secure XML parsing practices, such as limiting recursion depth, disabling dangerous features like external entity resolution, and applying rate limiting and input validation.

Resource exhaustion through recursive parsing of XML in SOAP messages explains this attack. SOAP is XML-based, and a carefully crafted, well-formed SOAP document can include self-referential or deeply nested structures that force the XML parser to recurse indefinitely or far beyond normal limits. As the parser keeps processing these recursive constructs, CPU and memory are consumed until the service slowdowns or crashes, achieving denial of service. This is what “recursive payloads” describe—the payload is designed to trigger endless or extremely deep parsing, not merely to be large or to manipulate headers.

The other options don’t fit this scenario. Oversize payloads rely on sheer size to exhaust resources rather than inducing infinite processing loops. SOAPAction is just a SOAP header value and doesn’t inherently force recursive parsing. Frame Injection concerns embedding content to influence how web pages display or behave, not XML parsing inside SOAP. To guard against this, use secure XML parsing practices, such as limiting recursion depth, disabling dangerous features like external entity resolution, and applying rate limiting and input validation.