Skip to content

[H2] Unbounded memory keyed on attacker-controlled actor #26

Description

@lelu-auth

actorStats (totals/denies) and the anomaly tracker store per-actor state in maps keyed by the free-form actor string, with no eviction. Sending many distinct actor strings grows memory without bound → OOM.

Location: engine/internal/server/risk.go:223 and the anomaly tracker.

Fix: Use bounded state — LRU/TTL caches or external store (Redis) — for per-actor counters.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions