ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Java community SDK agent handler reads the entire request body into memory
- Lingua principale
- Python
- Stelle
- 15.9k
- Fork
- 1.4k
- Merge medio
- 1g 17h
- PR unite (30g)
- 163
Descrizione
# Java community SDK agent handler reads the entire request body into memory
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.
## Impact
A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.
## Suggested remediation
Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.