A social network exposes an endpoint to retrieve a user's followers: GET /api/users/{id}/followers?count=10. The count parameter is documented as defaulting to 10 and is intended to limit the results per page.
The developer implemented the parameter but forgot to set a maximum. The endpoint accepts any value for count — including very large numbers.
GET /api/users/1/followers?count=99999999. The API queries the database for up to 99,999,999 follower records. The database runs a full table scan. The API tries to serialize millions of objects into a single JSON response. The server's memory spikes. The database is saturated. The response takes minutes to return — or the server crashes. Every other user's request fails during this time.This scenario requires exactly one attacker making one request. No botnet. No coordination. No special tooling. Just a number in a URL parameter. The absence of a max page size turns a single API call into a denial-of-service weapon.