server_listen() calls accept_loop() which fork()s for every incoming connection with no limit. An attacker can open thousands of connections, causing a fork bomb that exhausts the process table and memory.
Connect repeatedly to the server port. Each connection spawns a new process via fork(). No limit is enforced.
Suggested Fix
Add --max-connections <n> (default e.g. 100) to the server
Track child process count via SIGCHLD handler with a counter
When limit is reached, close(fd) the new connection without forking
Reap children promptly (waitpid in a loop in the signal handler)
Severity
high
Category
security
Sub-Agent
security-screener (SC-2)
This issue was automatically generated by the issue-creator agent.
## Description
`server_listen()` calls `accept_loop()` which `fork()`s for every incoming connection with no limit. An attacker can open thousands of connections, causing a fork bomb that exhausts the process table and memory.
## Location
src/shared/transport_tcp.c:155-186 (accept_loop)
src/server/server.c
## How to trigger
Connect repeatedly to the server port. Each connection spawns a new process via `fork()`. No limit is enforced.
## Suggested Fix
1. Add `--max-connections <n>` (default e.g. 100) to the server
2. Track child process count via `SIGCHLD` handler with a counter
3. When limit is reached, `close(fd)` the new connection without forking
4. Reap children promptly (`waitpid` in a loop in the signal handler)
## Severity
high
## Category
security
## Sub-Agent
security-screener (SC-2)
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
server_listen()callsaccept_loop()whichfork()s for every incoming connection with no limit. An attacker can open thousands of connections, causing a fork bomb that exhausts the process table and memory.Location
src/shared/transport_tcp.c:155-186 (accept_loop)
src/server/server.c
How to trigger
Connect repeatedly to the server port. Each connection spawns a new process via
fork(). No limit is enforced.Suggested Fix
--max-connections <n>(default e.g. 100) to the serverSIGCHLDhandler with a counterclose(fd)the new connection without forkingwaitpidin a loop in the signal handler)Severity
high
Category
security
Sub-Agent
security-screener (SC-2)
This issue was automatically generated by the issue-creator agent.
Fixed in PR #148 — merged into main on 2026-07-29. See #148