Security: Unbounded per-connection WebSocket send queue (memory DoS) #81

New issue

Closed

opened 2026-07-08 02:40:30 +00:00 by icub3d · 0 comments

icub3d commented

2026-07-08 02:40:30 +00:00

Owner

Severity: High — found in code review 2026-07-07.

Problem

server/src/gateway/connection.rs:30 uses mpsc::unbounded_channel::<String>() for each connection's outbound queue. Every broadcast_all (joins/leaves, messages, role events) pushes to each connection's sender. A client that connects, authenticates, then stops reading grows its queue without bound as server activity continues — one idle socket per attacker exhausts server memory. The heartbeat-ack timeout doesn't bound an un-flushed backlog.

Fix

Use a bounded channel; drop the connection (or shed messages) when the buffer fills.

Acceptance

Slow/stalled consumer is disconnected rather than growing memory unboundedly (test)

**Severity: High** — found in code review 2026-07-07. ## Problem `server/src/gateway/connection.rs:30` uses `mpsc::unbounded_channel::<String>()` for each connection's outbound queue. Every `broadcast_all` (joins/leaves, messages, role events) pushes to each connection's sender. A client that connects, authenticates, then **stops reading** grows its queue without bound as server activity continues — one idle socket per attacker exhausts server memory. The heartbeat-ack timeout doesn't bound an un-flushed backlog. ## Fix - [ ] Use a bounded channel; drop the connection (or shed messages) when the buffer fills. ## Acceptance - [ ] Slow/stalled consumer is disconnected rather than growing memory unboundedly (test)

icub3d added the

area:api

status:planned

type:bug

labels

2026-07-08 02:40:31 +00:00

icub3d referenced this issue

2026-07-08 02:40:47 +00:00

Feature: API and Gateway Rate Limiting #48

icub3d referenced this issue from a commit

2026-07-08 03:48:59 +00:00

fix(gateway): bound per-connection send queue to prevent memory DoS