AIKIDO-2026-935066

TL;DR

The Streamable HTTP, Stateless, and SSE server transports buffer an entire incoming HTTP request body into memory before parsing it, without any limit on how large that body can be. A request that streams a large body using chunked transfer encoding bypasses the Content-Length check and is read in an unbounded loop. Processing such a request drives heap growth until the JVM throws OutOfMemoryError, denying service to other clients. The fix adds a configurable request body size limit and rejects oversized requests with an HTTP 413 response.