fix(security): [OBE-10709,OBE-10712,OBE-10718,OBE-11232,OBE-11234,OBE-11235,OBE-11236,OBE-11238,OBE-11555,OBE-11556] OOM/unbounded allocation bounds - #138

Open

JuanMantica45 wants to merge 16 commits into

Sentinel-One:masterfrom

JuanMantica45:security-oom-bounds

Commits on Aug 7, 2026

docs(specs): add security OOM allocation bounds spec

JuanMantica45
and
claude
committed
cd930a5
docs(plans): add OOM/unbounded allocation bounds implementation plan

JuanMantica45
and
claude
committed
c86fbcf
fix(logstash): [OBE-10712] cap decompressed frame size, reject nested compressed frames

JuanMantica45
and
claude
committed
b034a7f
fix(tcp): [OBE-11555] release RequestLimiterPermit before ack write_all

JuanMantica45
and
claude
committed
e990543
fix(codecs): [OBE-11232] default NewlineDelimitedDecoder to 100 KiB max_length

JuanMantica45
and
claude
committed
15c3bc3
fix(codecs): [OBE-11235] set finite defaults for GELF pending_messages_limit and max_length

JuanMantica45
and
claude
committed
0153d5a
trivial: update progress checklist — Tasks 2, 4, 5, 10 integrated
JuanMantica45
committed
b170eb5
test(logstash): [OBE-10712] add unit tests for decompression bomb and nested C guards
JuanMantica45
committed
637e03e
chore: bump lib/observo/private to security-oom-bounds (Tasks 1, 7, 3)
JuanMantica45
committed
2b175f6
trivial: update progress checklist — Tasks 1, 3, 7 integrated
JuanMantica45
committed
683cf21
fix(codecs): [OBE-11235] replace O(N) per-message tokio::spawn with DelayQueue reaper

JuanMantica45
and
claude
committed
bd3735b
fix(codecs): [OBE-11235] drop unused timeout field from ChunkedGelfDecoder

JuanMantica45
and
claude
committed
a43b463
chore: update private submodule pointer (OBE-11234, OBE-11556)

JuanMantica45
and
claude
committed
17debea
trivial: mark Tasks 6, 8, 9 complete in plan
JuanMantica45
committed
e76fee3
chore(docs): resolve planning artifacts for security-oom-allocation-bounds

JuanMantica45
and
claude
committed
9a97ddf
chore(docs): remove ADR from vector repo
JuanMantica45
committed
2b5ba9b

Navigation Menu

Uh oh!

fix(security): [OBE-10709,OBE-10712,OBE-10718,OBE-11232,OBE-11234,OBE-11235,OBE-11236,OBE-11238,OBE-11555,OBE-11556] OOM/unbounded allocation bounds - #138

fix(security): [OBE-10709,OBE-10712,OBE-10718,OBE-11232,OBE-11234,OBE-11235,OBE-11236,OBE-11238,OBE-11555,OBE-11556] OOM/unbounded allocation bounds#138
JuanMantica45 wants to merge 16 commits into
Sentinel-One:masterfrom
JuanMantica45:security-oom-bounds

Commits on Aug 7, 2026

docs(specs): add security OOM allocation bounds spec

docs(plans): add OOM/unbounded allocation bounds implementation plan

fix(logstash): [OBE-10712] cap decompressed frame size, reject nested compressed frames

fix(tcp): [OBE-11555] release RequestLimiterPermit before ack write_all

fix(codecs): [OBE-11232] default NewlineDelimitedDecoder to 100 KiB max_length

fix(codecs): [OBE-11235] set finite defaults for GELF pending_messages_limit and max_length

trivial: update progress checklist — Tasks 2, 4, 5, 10 integrated

test(logstash): [OBE-10712] add unit tests for decompression bomb and nested C guards

chore: bump lib/observo/private to security-oom-bounds (Tasks 1, 7, 3)

trivial: update progress checklist — Tasks 1, 3, 7 integrated

fix(codecs): [OBE-11235] replace O(N) per-message tokio::spawn with DelayQueue reaper

fix(codecs): [OBE-11235] drop unused timeout field from ChunkedGelfDecoder

chore: update private submodule pointer (OBE-11234, OBE-11556)

trivial: mark Tasks 6, 8, 9 complete in plan

chore(docs): resolve planning artifacts for security-oom-allocation-bounds

chore(docs): remove ADR from vector repo