Slowloris exploits the open connections of a web server by sending a partial request without ever completing them. This can fill up the maximum concurrent connection pool quickly that results in denial of service for legitimate requests.