ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Java community SDK agent handler reads the entire request body into memory
- Ngôn ngữ chính
- Python
- Star
- 15.9k
- Fork
- 1.4k
- Merge trung bình
- 1 ngày 17 giờ
- Pull request đã merge (30 ngày)
- 163
Mô tả
# Java community SDK agent handler reads the entire request body into memory
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.
## Impact
A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.
## Suggested remediation
Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.