ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Java community SDK agent handler reads the entire request body into memory
- Lenguaje dominante
- Python
- Estrellas
- 15.9k
- Forks
- 1.4k
- Merge medio
- 1 d 17 h
- PR fusionados (30 d)
- 163
Descripción
# Java community SDK agent handler reads the entire request body into memory
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.
## Impact
A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.
## Suggested remediation
Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.