Description
Several API handlers call ShouldBindJSON without an application-level request-body limit. Large request bodies can consume avoidable memory and connection-processing time before binding fails or completes.
- CWE: CWE-770
- CVSS v3.1:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (3.7)
- Audited revision:
85b1652
Suggested remediation
Add route middleware using http.MaxBytesReader, with endpoint-specific limits where needed. Return HTTP 413 for oversized bodies and cover ordinary plus chunked uploads in tests.
The default unauthenticated Console configuration reported separately broadens the practical exposure of this hardening gap.
Description
Several API handlers call
ShouldBindJSONwithout an application-level request-body limit. Large request bodies can consume avoidable memory and connection-processing time before binding fails or completes.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L(3.7)85b1652Suggested remediation
Add route middleware using
http.MaxBytesReader, with endpoint-specific limits where needed. Return HTTP 413 for oversized bodies and cover ordinary plus chunked uploads in tests.The default unauthenticated Console configuration reported separately broadens the practical exposure of this hardening gap.