ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Java community SDK agent handler reads the entire request body into memory
- 主要语言
- Python
- 星标
- 15.9k
- 派生
- 1.4k
- 平均合并
- 1 天 17 小时
- 30 天内合并 PR
- 163
描述
# Java community SDK agent handler reads the entire request body into memory
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.
## Impact
A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.
## Suggested remediation
Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.
贡献指南
评估
这个 Issue 还没有评估数据。