René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"OOM a potential denial of service in the CGI server on Windows","articleBody":"When `http.server.CGIHTTPRequestHandler` on Windows (and other platforms without `fork()`) handles the POST request, it reads the whole body of the POST request in memory before sending it to the subprocess running the script. The underlying SocketIO allocates the amount of memory specified in the `Content-Length` header before actual reading the data, so a small request with incorrect `Content-Length` can cause consumption of the large amount of memory and CPU time and can be used in the DOS attack on the server.\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-119455\n* gh-142130\n* gh-142131\n* gh-142132\n* gh-142133\n* gh-142176\n* gh-142178\n* gh-142180\n* gh-142181\n* gh-142184\n* gh-142185\n* gh-142216\n* gh-142296\n* gh-142297\n* gh-142298\n* gh-142299\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/serhiy-storchaka","@type":"Person","name":"serhiy-storchaka"},"datePublished":"2024-05-23T08:29:06.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/119452/cpython/issues/119452"}