ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Java community SDK agent handler reads the entire request body into memory

Aperta
#2,441 2 commenti 0 reazioni 1 assegnatario Rivendicata da @Jokasa7 Vedi su GitHub
Lingua principale
Python
Stelle
15.9k
Fork
1.4k
Merge medio
1g 17h
PR unite (30g)
163

Descrizione

# Java community SDK agent handler reads the entire request body into memory

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.

## Impact

A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.

## Suggested remediation

Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.