NAT table exhaustion happens when a network address translation device runs out of connection-tracking entries. NAT does not only rewrite addresses and ports; it also stores state for each active flow so return traffic reaches the right host. If that table is filled, new sessions may be blocked, delayed, or forced to wait for old entries to time out.
In cyber security, this matters because exhaustion can be used as a denial-of-service technique. An attacker may open many connections, send short-lived bursts, or trigger repetitive NAT mappings to consume limited state. Defenders look for spikes in session count, unusual source behavior, and premature table growth. Common mitigations include rate limiting, shorter idle timeouts, capacity tuning, and separating critical services from heavily shared NAT devices.