AIKIDO-2026-237477

TL;DR

The penetration detector engine bounds how much request body it reads through a cap that is only enforced when a Content-Length header is present, and treats a missing header as under the cap. A request sent with Transfer-Encoding: chunked carries no Content-Length, so the check fails and the middleware reads the entire stream into memory and then decodes it to text. An unauthenticated client can send a large chunked body to any route the middleware covers and consume large amounts of server memory. The fix reads only a bounded prefix of bodies that lack a usable Content-Length and applies a wall-clock read timeout so the unbounded read no longer happens.