Skip to content

Unbounded downstream frame queues allow remote memory exhaustion #683

Description

@bit-aloo

Downstream::new uses unbounded queues for incoming and outgoing SV2 frames. A connected peer can send frames faster than they are processed, causing the pool to retain an unlimited number of frames in memory without applying backpressure.

This can allow a remote peer to exhaust the pool's memory and cause a denial of service.

The transport queues should have bounded capacity or enforce an equivalent limit.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    Todo 📝
    Status
    Todo 📝

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions