File tree Expand file tree Collapse file tree 1 file changed +6
-0
lines changed Expand file tree Collapse file tree 1 file changed +6
-0
lines changed Original file line number Diff line number Diff line change @@ -448,6 +448,12 @@ func WithWriteHandlerMiddlewares(middlewares ...func(http.Handler) http.Handler)
448448 }
449449}
450450
451+ // maxDecodedSize limits the maximum allowed size of decompressed snappy payloads.
452+ // This protects against maliciously crafted payloads that could cause excessive memory
453+ // allocation and potentially lead to out-of-memory (OOM) conditions.
454+ // All usual payloads should be much smaller than this limit and pass without any problems.
455+ //
456+ // See more in https://github.com/prometheus/client_golang/pull/1917
451457const maxDecodedSize = 32 * 1024 * 1024
452458
453459// SnappyDecodeMiddleware returns a middleware that checks if the request body is snappy-encoded and decompresses it.
You can’t perform that action at this time.
0 commit comments