ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Go community SDK accumulates SSE events without bounds
- Lenguaje dominante
- Python
- Estrellas
- 15.9k
- Forks
- 1.4k
- Merge medio
- 1 d 17 h
- PR fusionados (30 d)
- 163
Descripción
# Go community SDK accumulates SSE events without bounds
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Go SDK — `sdks/community/go/pkg/client/sse/client.go:191-303`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The SSE client appends incoming event data, event lines, and id lines without per-item or total-size caps. Nothing bounds memory growth during a single stream.
## Impact
A misbehaving or malicious agent endpoint can grow the client's memory without limit over the course of one connection. Availability only — no code execution or data access.
## Suggested remediation
Adopt a cap set equivalent to the Dart SDK's reference implementation (per-event size, per-id size, total stream budget; Dart enforces an 8 MiB data cap, id length cap, and NUL rejection).
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.