No connection limit on server creates fork bomb DoS vector #113

New Issue

2026-07-21T16:20:38+02:00

TapTap commented

2026-07-21 16:20:38 +02:00

Description

server_listen() calls accept_loop() which fork()s for every incoming connection with no limit. An attacker can open thousands of connections, causing a fork bomb that exhausts the process table and memory.

Location

src/shared/transport_tcp.c:155-186 (accept_loop)
src/server/server.c

How to trigger

Connect repeatedly to the server port. Each connection spawns a new process via fork(). No limit is enforced.

Suggested Fix

Add --max-connections <n> (default e.g. 100) to the server
Track child process count via SIGCHLD handler with a counter
When limit is reached, close(fd) the new connection without forking
Reap children promptly (waitpid in a loop in the signal handler)

Severity

high

Sub-Agent

security-screener (SC-2)

This issue was automatically generated by the issue-creator agent.

## Description `server_listen()` calls `accept_loop()` which `fork()`s for every incoming connection with no limit. An attacker can open thousands of connections, causing a fork bomb that exhausts the process table and memory. ## Location src/shared/transport_tcp.c:155-186 (accept_loop) src/server/server.c ## How to trigger Connect repeatedly to the server port. Each connection spawns a new process via `fork()`. No limit is enforced. ## Suggested Fix 1. Add `--max-connections <n>` (default e.g. 100) to the server 2. Track child process count via `SIGCHLD` handler with a counter 3. When limit is reached, `close(fd)` the new connection without forking 4. Reap children promptly (`waitpid` in a loop in the signal handler) ## Severity high ## Category security ## Sub-Agent security-screener (SC-2) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:13 +02:00

TapTap commented

2026-07-29 18:27:31 +02:00