AIKIDO-2026-56796

TL;DR

The tracer's resizable msgpack write buffer grows its backing allocation without any upper bound while serializing trace payloads. A single pathological span, such as a multi-megabyte stack trace or an oversized unsanitized meta tag, can force the buffer to grow until the allocation fails and crashes the host process. Because span data can be derived from attacker-influenced input, an instrumented application can be driven to out-of-memory termination. The fix caps buffer growth at the 50 MiB agent intake limit and throws a tagged ERR_MSGPACK_CHUNK_OVERFLOW overflow error so oversized payloads are dropped instead of exhausting memory.