In this paper, a new filtering fusion problem is studied for nonlinear cyber-physical systems under error-variance constraints and denial-of-service attacks. To prevent data collision and reduce communication cost, the stochastic communication protocol is adopted in the sensor-to-filter channels to regulate the transmission order of sensors. Each sensor is allowed to enter the network according to the transmission priority decided by a set of independent and identically-distributed random variables. From the defenders' view, the occurrence of the denial-of-service attack is governed by the randomly Bernoulli-distributed sequence. At the local filtering stage, a set of variance-constrained local filters are designed where the upper bounds (on the filtering error covariances) are first acquired and later minimized by appropriately designing filter parameters. At the fusion stage, all local estimates and error covariances are combined to develop a variance-constrained fusion estimator under the federated fusion rule. Furthermore, the performance of the fusion estimator is examined by studying the boundedness of the fused error covariance. A simulation example is finally presented to demonstrate the effectiveness of the proposed fusion estimator.