Documented incidentDate not recordedAmazon Web ServicesEngineering design article

Design reference: AWS guidance on timeouts, retries and backoff with jitter

AWS describes retries as powerful but dangerous: when a dependency is struggling, too many retries can amplify load and turn a partial failure into a retry storm.

What happened

  • The article recommends timeouts, capped exponential backoff and jitter to keep retries from synchronising.Timeouts, retries, and backoff with jitter

The failure pattern

Retry amplification and runaway resource consumptionRetries, loops or an expensive input multiply load until a partial failure becomes a full outage or a runaway bill.How to prevent it
Watch the pattern: Retry amplification and runaway resource consumption

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Use capped exponential backoff with jitterSpread retries over time and cap attempts so clients do not synchronise into a storm.
  • Retry at one layer with a budgetAvoid multiplying retries across layers; bound retries with a budget relative to normal traffic.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern

Security advisory2026-10-16

Software component issue could make the service unavailable

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit…

Retry amplification and runaway resource consumptionnvd.nist.gov
Security advisory2026-10-16

Software component issue could make the service unavailable

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSECGSS (Remote…

Retry amplification and runaway resource consumptionnvd.nist.gov