A cache stampede occurs when many requests regenerate the same expired entry at once. Use request coalescing/single-flight, a short lock, probabilistic early refresh, or stale-while-revalidate. Cache penetration occurs when repeated requests for nonexistent keys bypass the cache; use short-lived negative caching, validation, and possibly a Bloom filter for large key sets. Apply limits so attackers cannot force unlimited expensive lookups.