ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Java community SDK agent handler reads the entire request body into memory

Ouverte
#2,441 2 commentaires 0 réactions 1 personne assignée Réclamée par @Jokasa7 Voir sur GitHub
Langage dominant
Python
Étoiles
15.9k
Forks
1.4k
Merge moyen
1 j 17 h
PR mergées (30 j)
163

Description

# Java community SDK agent handler reads the entire request body into memory

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.

## Impact

A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.

## Suggested remediation

Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.