RockteMQ-AI commented on issue #1724: URL: https://github.com/apache/rocketmq-dashboard/issues/1724#issuecomment-5252974001
## Issue Evaluation Category: `type/bug` | Status: **Confirmed** The issue is valid. Unbounded response body reads from OpenAI-compatible providers create a memory exhaustion vector — a misbehaving or malicious provider endpoint could send an arbitrarily large response that the Studio backend would attempt to buffer entirely in memory. **Root Cause:** No `Content-Length` cap or streaming limit on HTTP response reads in the LLM client. **Impact:** Security/reliability — potential OOM under adversarial conditions. **Severity:** High The proposed fix (bound response bodies to a configurable max, default ~1MB) is appropriate. A fix PR can be generated. Reply `/approve` to proceed. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
