Connection exhaustion is a denial-of-service technique that ties up a service’s limited capacity for active connections. Attackers open many sessions and keep them alive, consuming resources such as file descriptors, memory, connection slots, or application workers. The sessions may exchange little data, so the target can be strained even when network traffic volume is not unusually high.
In real attacks, compromised devices may coordinate to maintain large numbers of established TCP connections to a target. Unlike a SYN flood, which targets the connection handshake before completion, connection exhaustion uses established sessions. Defenders can monitor active and idle connection counts, session duration, and worker or connection-pool saturation. Tested idle timeouts and appropriate per-client or service-specific limits can help preserve capacity while allowing legitimate long-lived connections.