Aias00 opened a new issue, #6758: URL: https://github.com/apache/shenyu/issues/6758
- severity: Medium - files: `shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:349-392` - description: `appendResponse` writes every processed chunk into a `BodyWriter` backed by an unbounded `ByteArrayOutputStream`, solely so the `doFinally` fallback can regex-scan the full output if per-chunk parsing missed `completion_tokens`. For a long non-gzip SSE stream this accumulates the entire response in heap with no cap. - impact: A large streaming AI response can exhaust gateway heap even without gzip. - suggested_fix: Cap the buffered bytes (ring/last-N-KB buffer); only the final usage chunk is needed. - confidence: Medium - related_existing: none — SEC-9 is the gzip Inflater path; this is a distinct OOM vector from unbounded plain-byte accumulation. --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
