Uploaded image for project: 'Geode'
  1. Geode
  2. GEODE-9676

Limit Radish RESP bulk input sizes for unauthenticated connections

    XMLWordPrintableJSON

Details

    Description

      Redis recently implemented a response to a CVE which allows for unauthenticated users to craft RESP requests which consume a lot of memory. Our implementation suffers from the same problem.

      For example, a command input starting with `*<MAX_INT>` would result in the JVM trying to allocate an array of size `MAX_INT`. 

      We need to be able to provide the same safeguards as Redis does.

      Attachments

        Issue Links

          Activity

            People

              jens.deppe Jens Deppe
              jens.deppe Jens Deppe
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: