AIKIDO-2026-412779

TL;DR

The IPP protocol layer's request reader copies the entire attacker-supplied IPP document payload into an in-memory stream with no size limit. Because document buffering is enabled by default and the documented server setup passes an unauthenticated HTTP request body straight into the receive path, a remote attacker can send an arbitrarily large request body to exhaust process memory. This can trigger an out-of-memory condition that crashes the host process and makes the IPP service unavailable. The fix adds a configurable maximum document size that rejects oversized payloads with a request-entity-too-large error.