AIChat 0.30.0 HTTP Request Body DoS: Unbounded Buffering Fix & PoC

AIChat HTTP Service Request Body Handling Denial of Service (DoS) Vulnerability Summary Vulnerability Overview The OpenAI-compatible HTTP service mode of AIChat is susceptible to a Denial of Service (DoS) vulnerability. The routes , , , and buffer the entire HTTP request body in memory but lack pre-read request body size limits, JSON depth limits, array element limits, string length limits, API authentication, per-client rate limiting, or concurrency budgets. When AIChat is deployed as a shared local gateway, an internal service, a containerized application, or a reverse proxy backend, unauthenticated clients can send oversized request bodies, forcing the service process to allocate memory, rendering normal model, playground, embedding, rerank, and RAG API requests unavailable. Impact Scope Affected Versions: AIChat 0.30.0 Vulnerable File: Affected Routes: , , , Root Cause: The HTTP dispatcher exposes OpenAI-compatible API paths directly and forwards requests to route handlers without authentication or request admission control; each affected POST handler first buffers the entire request body ( ), without pre-read size caps, quantity caps, quantity caps, quantity caps, or string length limits. Remediation 1. Enforce an HTTP request body size cap before . 2. Return when JSON parsing or streaming reads exceed the limit. 3. Add API authentication or an explicit local-only gateway mode, or use bind/non-loopback address-based restrictions. 4. Add schema limits, string length limits, and JSON nesting depth limits for , , , , and . 5. Replace full buffering with bounded streaming reads where possible. 6. Add per-IP or per-client rate limiting and concurrent request limits. 7. Avoid logging the full request body in debug mode. 8. Add regression tests: send oversized request bodies to each POST route and assert rejection behavior and model dispatch. POC Code ```powershell $Image = "aichat-serve-body-dos-repro-0.30.0" $Container = "aichat-serve-body-dos-repro" $BaseUri = "http://127.0.0.1:8080" $Payload = "E:\agent_vul\aichat-0.30.0\aichat-0.30.0" $Bin = "E:\agent_vul\aichat-0.30.0\aichat-0.30.0\security-repro\serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-body-dos\bin\security-repro-serve-

Goal Reached Thanks to every supporter — we hit 100%!

AIChat 0.30.0 HTTP Request Body DoS: Unbounded Buffering Fix & PoC

More from this source