Summary
The HTTP acquisition datasource does not bound the size of request bodies it buffers. A client holding valid log-source credentials can send a single request that causes the Security Engine to allocate memory until the process is terminated by the OOM killer.
Details
In processRequest (pkg/acquisition/modules/http/run.go), the body size check is evaluated against Content-Length, and gzip-encoded bodies are decompressed with no limit on the output. The decoded value is unmarshalled into json.RawMessage, which buffers it in full.
Three ways through:
MaxBodySize has no default. SetDefaults in config.go sets only Mode and Path, so on a stock configuration the pointer is nil and the guard is skipped entirely. A large plain JSON body is buffered without limit.- When
MaxBodySize is set, the guard runs against the compressed length. gzip.NewReader then inflates without a cap, so a small compressed body expands to whatever the attacker chose.
Content-Length is -1 for chunked requests and for HTTP/2. -1 > limit is false, so the guard is skipped. The source calls SetUnencryptedHTTP2(true).
The decoder reads into json.RawMessage, which buffers the whole value.
Impact
An authenticated log-source client (the datasource requires basic_auth, headers or mtls) sends one request and the Security Engine is OOM-killed.
Affected configurations
The HTTP acquisition datasource is opt-in and is not enabled by a default installation. Instances are affected only where this datasource is configured, and reachable by untrusted 3rd parties that have access to the credentials to push logs.
Workaround
Restrict network access to the datasource listener to known senders.
arpitjain099 Reporter
Summary
The HTTP acquisition datasource does not bound the size of request bodies it buffers. A client holding valid log-source credentials can send a single request that causes the Security Engine to allocate memory until the process is terminated by the OOM killer.
Details
In
processRequest(pkg/acquisition/modules/http/run.go), the body size check is evaluated againstContent-Length, and gzip-encoded bodies are decompressed with no limit on the output. The decoded value is unmarshalled intojson.RawMessage, which buffers it in full.Three ways through:
MaxBodySizehas no default.SetDefaultsinconfig.gosets onlyModeandPath, so on a stock configuration the pointer is nil and the guard is skipped entirely. A large plain JSON body is buffered without limit.MaxBodySizeis set, the guard runs against the compressed length.gzip.NewReaderthen inflates without a cap, so a small compressed body expands to whatever the attacker chose.Content-Lengthis -1 for chunked requests and for HTTP/2.-1 > limitis false, so the guard is skipped. The source callsSetUnencryptedHTTP2(true).The decoder reads into
json.RawMessage, which buffers the whole value.Impact
An authenticated log-source client (the datasource requires
basic_auth,headersormtls) sends one request and the Security Engine is OOM-killed.Affected configurations
The HTTP acquisition datasource is opt-in and is not enabled by a default installation. Instances are affected only where this datasource is configured, and reachable by untrusted 3rd parties that have access to the credentials to push logs.
Workaround
Restrict network access to the datasource listener to known senders.