ag-ui-protocol / ag-ui-protocol/ag-ui
[BUG]: Java community SDK agent handler reads the entire request body into memory
- 主要語言
- Python
- 星號
- 15.9k
- 分支
- 1.4k
- 平均合併
- 1 天 17 小時
- 30 天內合併 PR
- 163
描述
# Java community SDK agent handler reads the entire request body into memory
Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)
## Summary
The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.
## Impact
A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.
## Suggested remediation
Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.
貢獻指南
評估
這個 Issue 還沒有評估資料。