Slowloris
A low-bandwidth DoS — open lots of HTTP connections and send headers very slowly, one byte at a time. The web server exhausts its thread/connection pool.
Written by Robert "RSnake" Hansen in 2009. Effective against Apache (one thread per connection) and IIS. Nginx and Caddy (event-loop based) are immune because they don't allocate a thread per connection. Defences: rate-limit new connections per IP, connection timeouts for slow headers (http_limit_req_module, client_header_timeout), front proxies like mod_qos. Cloudflare/AWS WAF have dedicated mitigations. Ancient technique that still shows up on poorly configured Apache installs.