Web Cache Overflow: Sloppy Cache Keys Let Attackers Flood Caches With Redundant Copies of the Same Object

arXiv 2608.04744·medium signalXBlueskyLinkedInCopy link

Web caches key stored objects on HTTP request fields, and operators routinely include fields that do not affect the response, letting a client craft many requests that fetch the same object under different keys. Sustained generation of these redundant entries degrades cache effectiveness and pushes load back to the origin, enabling eviction-dependent attacks and potentially denial of service. The authors reproduce the degradation across five stand-alone caching proxies and characterize how key parameters trade off attacker cost against hit rate, concluding that precise cache-key design should be treated as a security best practice rather than a performance tuning detail.