Slowloris is a denial-of-service technique that keeps many HTTP connections open by sending incomplete requests over time. The server waits for each request to finish and eventually exhausts its available connections, which prevents legitimate traffic from being served and causes application unavailability.
How a Slowloris attack works
A Slowloris attack abuses the gap between connection establishment and request completion. The attacker opens many HTTP sessions, then sends headers or partial requests slowly enough that the server keeps each connection alive instead of timing out, which ties up concurrency slots without needing high bandwidth.
This makes the technique especially effective against servers that allocate a limited pool of worker threads, file descriptors, or connection slots per client. The issue is not volume in the usual flood sense, but resource starvation through protocol patience.
Why it succeeds against web servers
Slowloris works because many HTTP stacks must hold state while waiting for a request to finish. When enough sockets remain half-open, legitimate users are queued out even though the attacker is sending relatively little traffic.
The attack is most practical where timeouts are generous, per-connection resources are scarce, or upstream devices do not aggressively terminate slow clients. Reverse proxies, load balancers, and HTTP server configuration all influence whether the server can absorb or shed this kind of pressure.
Operational impact on availability
The direct impact is application unavailability for real users. Even if the server host is not fully saturated at the network layer, the service may appear “up” while silently refusing new or progressing requests because its HTTP worker capacity is exhausted.
For business systems, that means failed logins, broken checkout flows, stalled APIs, and a degraded user experience that can resemble an outage. Slowloris is therefore a denial-of-service technique that targets service responsiveness and concurrency more than raw throughput.
Defensive controls that reduce exposure
Slowloris is mitigated by making the server less tolerant of incomplete or idle requests. Shorter header and request timeouts, per-connection limits, connection draining, and front-end devices that terminate slow clients all reduce the attack surface.
Capacity planning also matters, because the same configuration can be resilient in one deployment and fragile in another. CISA cyber threat advisories are a useful starting point for current denial-of-service patterns, while NIST Cybersecurity Framework 2.0 helps teams tie availability protection to govern, protect, detect, respond, and recover outcomes.
Risk and Threat Considerations
Slowloris is risky because it can deny service with very low attacker cost and without obvious bandwidth spikes. Environments that expose HTTP services directly, rely on limited worker pools, or allow long-lived idle connections are more exposed than teams often expect.
Failure mechanism: The attacker keeps enough connections half-open that the server holds state and reserves workers for incomplete requests until new legitimate traffic cannot be served.
Impact: Users experience timeouts, failed sessions, and partial outages, and the service may require configuration changes or traffic filtering before normal operation is restored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.IR-01 — Network Resilience | Slowloris is an availability attack that exploits connection handling limits. |
| DE.CM-01 — Network Monitoring | Detection depends on spotting abnormal long-lived HTTP connections and request timing anomalies. | |
| Recommendation — Tune connection handling and timeout settings to preserve service availability under slow-request pressure. Monitor HTTP session duration and request pacing to detect slow-connection abuse. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | This control family covers monitoring and defensive measures against traffic-based service disruption. |
| Recommendation — Use network defense controls to identify and block slow-request denial-of-service patterns. | ||
| NIST SP 800-53 Rev 5 | SC-5 — Denial of Service Protection | Slowloris is a classic denial-of-service technique against service availability. |
| SI-4 — System Monitoring | Monitoring is needed to observe long-lived connections and abnormal request behavior. | |
| Recommendation — Apply denial-of-service protections that limit the impact of resource-starvation attacks. Detect abnormal connection persistence and request pacing through system monitoring. | ||
Practitioner Guidance
What to watch for: Treat unusually high counts of open but low-throughput HTTP sessions, long header transmission times, and repeated client disconnects as warning signs. Those patterns usually mean the service is being constrained by connection handling rather than ordinary load.
Governance implication: Availability hardening for web services should be owned as a configuration and resilience issue, not left as an incidental server default. Teams should validate that timeouts, request limits, and upstream proxy behavior are consistent across environments.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
