An e-commerce site should reserve products for a user while they're going through the payment process (more info). This creates a potential denial-of-service risk where an attacker could reserve many products and never complete payment - reserving all the stock and preventing legitimate sales.
How can this be defended against?
One option I considered is doing as much verification as possible on the user before allowing reservations. But there's not much verification you can do - the whole idea is that anyone can buy from your store. You could potentially require a verified email, but that's inconvenient for users, and it's still quite easy for an attacker to verify a large batch of emails.