Which CVSSv3 metric value increases when attacks consume network bandwidth, processor cycles, or disk space?

Confidentiality measures unauthorized disclosure of information, not resource exhaustion.

Integrity measures unauthorized modification or destruction of data, not the consumption of system resources.

In CVSSv3, the Availability (A) metric measures the impact on the accessibility of the affected component. Attacks that exhaust network bandwidth, processor cycles, or disk space - classic denial-of-service conditions - directly prevent legitimate users from accessing the resource, which is the definition of reduced availability. A high Availability score indicates the component becomes completely unavailable.

Attack Complexity describes the conditions or prerequisites required to exploit a vulnerability, not the impact on system resources after exploitation.