spring-projects / spring-projects/spring-framework

Introduce configurable limits in String, ByteArray and Resource message converters

Open
#37,267 3 comments 0 reactions 1 assignee View on GitHub

@bclozel is already working on this.

Since Sep 10, 2026.

in: web type: enhancement
Dominant language
Java
Stars
60.2k
Forks
38.8k
Avg merge
5d 2h
Merged PRs (30d)
27

Description

Reactive codecs provide a maxInMemorySize configuration option to limit the amount of in-flight native memory being used at runtime. This doesn't apply to traditional message converters for many reasons.

Many HttpMessageConverters provide ways to limit the memory being allocated on a per message basis, usually through the underlying library (like Jackson). This can be quite complex depending on the message format.

In the case of StringHttpMessageConverter, ByteArrayHttpMessageConverter and ResourceHttpMessageConverter, Spring Framework does not use any library and has control over the allocation. We should introduce a mechanism that developers can use to enforce maximum memory usage on a per decoded message basis. We're not sure yet whether this should be a "shared" mechanism or if each converter should be considered separately. Converters could then throw ContentTooLargeException to better reflect why the request is failing.

This is being considered by the Spring team and requires some more internal discussion and design before we can consider implementations. Contributions are not welcomed at this stage.

Thanks to @waydeshi for reaching out and discussing this matter.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.