ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Java community SDK agent handler reads the entire request body into memory

Offen
#2,441 2 Kommentare 0 Reaktionen 1 zugewiesene Person Beansprucht von @Jokasa7 Auf GitHub ansehen
Vorherrschende Sprache
Python
Sterne
15.9k
Forks
1.4k
Ø Merge
1 T. 17 Std.
Gemergte PRs (30 T.)
163

Beschreibung

# Java community SDK agent handler reads the entire request body into memory

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.

## Impact

A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.

## Suggested remediation

Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.