No, it is no Denial of Service vulnerability. Even if a single browser were to constantly request resources from your server, it would likely not go down.
A Denial-of-Service attack can have multiple reasons:
- A vulnerability that causes the server to crash.
For example, an attacker can cause the server to read /dev/zero
. As the file is of infinite length, the server never stops and hangs.
- A vulnerability that causes the server to work a lot more on a response than the client for a request. This is called an amplification attack.
- Many many people request resources from your server, and your server doesn't have the memory and/or bandwidth to keep up. This is usually refered to as "Distributed Denial-of-Service" (DDoD).
As you see, your "redirect to self" vulnerability really doesn't fall in any of these categories, for multiple reasons:
- Any modern, non-malicious browser will stop redirects after a certain amount, and display an error message, as answered by Joseph.
- Even if that were not the case, URLs can only have a limited length, so you would end up with ~100 requests, not infinite ones.
- A malicious user could just keep holding Ctrl+F5 to infinitely refresh your page and get the exact same effect. The fact that they can do this is independent of your redirect, and can be done to any server.