receive_data() accepts up to 1GB per message (MAX_DATA_SIZE = 1024*1024*1024 in protocol.c:195). An attacker can request a 1GB allocation, causing memory pressure. Combined with no connection limit, this is a significant DoS vector.
Location
src/shared/protocol.c:195, 201
How to trigger
Connect and send a crafted header with size = 0x40000000 (1GB). The server allocates 1GB for the message. With multiple connections, the server runs out of memory.
Suggested Fix
Reduce MAX_DATA_SIZE to a more reasonable value (e.g., 256MB). Additionally, add a per-connection memory usage cap. Consider using a sliding window or streaming approach for large data instead of pre-allocating.
Severity
medium
Category
security
Sub-Agent
security-screener (SC-6)
This issue was automatically generated by the issue-creator agent.
## Description
`receive_data()` accepts up to 1GB per message (`MAX_DATA_SIZE = 1024*1024*1024` in protocol.c:195). An attacker can request a 1GB allocation, causing memory pressure. Combined with no connection limit, this is a significant DoS vector.
## Location
src/shared/protocol.c:195, 201
## How to trigger
Connect and send a crafted header with `size = 0x40000000` (1GB). The server allocates 1GB for the message. With multiple connections, the server runs out of memory.
## Suggested Fix
Reduce `MAX_DATA_SIZE` to a more reasonable value (e.g., 256MB). Additionally, add a per-connection memory usage cap. Consider using a sliding window or streaming approach for large data instead of pre-allocating.
## Severity
medium
## Category
security
## Sub-Agent
security-screener (SC-6)
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
receive_data()accepts up to 1GB per message (MAX_DATA_SIZE = 1024*1024*1024in protocol.c:195). An attacker can request a 1GB allocation, causing memory pressure. Combined with no connection limit, this is a significant DoS vector.Location
src/shared/protocol.c:195, 201
How to trigger
Connect and send a crafted header with
size = 0x40000000(1GB). The server allocates 1GB for the message. With multiple connections, the server runs out of memory.Suggested Fix
Reduce
MAX_DATA_SIZEto a more reasonable value (e.g., 256MB). Additionally, add a per-connection memory usage cap. Consider using a sliding window or streaming approach for large data instead of pre-allocating.Severity
medium
Category
security
Sub-Agent
security-screener (SC-6)
This issue was automatically generated by the issue-creator agent.
Fixed in PR #148 — merged into main on 2026-07-29. See #148