ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit

Aberta
#2,440 0 comentários 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
Python
Estrelas
15.9k
Forks
1.4k
Merge médio
1d 17h
PRs com merge (30d)
163

Descrição

# C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community C++ SDK — `src/stream/sse_parser.cpp:6-126`, `src/agent/http_agent.cpp:389`
CWE: CWE-400 (Uncontrolled Resource Consumption), CWE-674 (Uncontrolled Recursion)

## Summary

1. The 10 MB size cap is checked against the chunk buffer only; the per-event accumulator (`m_currentData`) grows without bound, so a single oversized event (delivered in many small chunks) bypasses the cap.
2. Event payloads are parsed with nlohmann::json without a depth limit; deeply nested JSON triggers unbounded recursion during parsing.

## Impact

Memory exhaustion via oversized single events, and hard process crashes (stack overflow / SIGSEGV) from maliciously nested JSON. Availability only.

## Suggested remediation

- Apply the size cap to the per-event accumulator, not only the chunk buffer.
- Configure an nlohmann parsing depth limit (or use an iterative parser).

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.