ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit
- Linguagem predominante
- Python
- Estrelas
- 15.9k
- Forks
- 1.4k
- Merge médio
- 1d 17h
- PRs com merge (30d)
- 163
Descrição
# C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community C++ SDK — `src/stream/sse_parser.cpp:6-126`, `src/agent/http_agent.cpp:389`
CWE: CWE-400 (Uncontrolled Resource Consumption), CWE-674 (Uncontrolled Recursion)
## Summary
1. The 10 MB size cap is checked against the chunk buffer only; the per-event accumulator (`m_currentData`) grows without bound, so a single oversized event (delivered in many small chunks) bypasses the cap.
2. Event payloads are parsed with nlohmann::json without a depth limit; deeply nested JSON triggers unbounded recursion during parsing.
## Impact
Memory exhaustion via oversized single events, and hard process crashes (stack overflow / SIGSEGV) from maliciously nested JSON. Availability only.
## Suggested remediation
- Apply the size cap to the per-event accumulator, not only the chunk buffer.
- Configure an nlohmann parsing depth limit (or use an iterative parser).
Guia de contribuição
Avaliação
Esta issue ainda não foi avaliada.