ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Go community SDK accumulates SSE events without bounds

Abierto
#2,438 1 comentario 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
15.9k
Forks
1.4k
Merge medio
1 d 17 h
PR fusionados (30 d)
163

Descripción

# Go community SDK accumulates SSE events without bounds

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Go SDK — `sdks/community/go/pkg/client/sse/client.go:191-303`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The SSE client appends incoming event data, event lines, and id lines without per-item or total-size caps. Nothing bounds memory growth during a single stream.

## Impact

A misbehaving or malicious agent endpoint can grow the client's memory without limit over the course of one connection. Availability only — no code execution or data access.

## Suggested remediation

Adopt a cap set equivalent to the Dart SDK's reference implementation (per-event size, per-id size, total stream budget; Dart enforces an 8 MiB data cap, id length cap, and NUL rejection).

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.