|Re: [jetty-users] OOM by huge header size attack: setResponseHeaderSize won't work|
We use NiFi which embeds Jetty Server. Our test team found a security bug by intercepting the http request and replacing the header with a huge (say 1GB) text, which sent the response to NCM, which got OOM:
2017-03-07 03:44:03,522 WARN [NiFi Web Server-22] o.a.n.c.m.impl.
HttpRequestReplicatorImpl Node request for [id=99a65e79-b856-4e43-9056- 1451714498fc, apiAddress=22.214.171.124, apiPort=38484, socketAddress=126.96.36.199, socketPort=39494, siteToSiteAddress=129.188.35. 109, siteToSitePort=null] encountered exception: java.util.concurrent. ExecutionException: java.lang.OutOfMemoryError: Java heap spaceWe tried setResponseHeaderSize here http://download.eclipse. org/jetty/stable-9/apidocs/but it didn't seem to work: it seems to us that the huge fake header got received before this limit takes effect, as a result, the NCM got OOM in the first place. org/eclipse/jetty/server/ HttpConfiguration.html# setResponseHeaderSize-int-Are we missing anything, or is there a potential bug with setResponseHeaderSize, please?Thanks,
jetty-users mailing list
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
Back to the top