Heap exhaustion happens when an application allocates so much object memory on the Java heap that it can no longer serve requests reliably. The process may slow down, trigger long garbage-collection pauses, throw out-of-memory errors, or crash. In web applications, this is often caused by attacker-controlled input that is accepted faster than it can be validated, limited, or freed.
In cyber security, heap exhaustion matters because it is a practical denial-of-service technique. An attacker may send oversized request bodies, deeply nested data, repeated parsing triggers, or inputs that force the server to build large in-memory structures. Defenders reduce the risk with request-size limits, streaming or incremental parsing, strict validation, backpressure, and monitoring for abnormal heap growth. In frameworks and plugins that read whole bodies into memory, a missing bound can turn normal traffic handling into a resource exhaustion flaw.