Summary
The unauthenticated enrollment endpoint (/edge/client/v1/enroll) with legacy MIME types (text/plain, application/pkcs7, application/x-pem-file) allocates the request body twice: once globally in CreateRequestContext (pre-auth, all routes) and again inside legacyGenericEnrollPemHandler via a second io.ReadAll. For a body of N bytes, the controller allocates 2N bytes of heap per request. An attacker who sends large-body requests with a legacy content type achieves double the memory pressure compared to the base body-exhaustion attack, halving the bandwidth required to trigger an out-of-memory condition.
Package
ziti
Affected versions
2.0.x-v2.0.1 v1.6.x-v1.6.17
Patched Versions
2.0.2, 1.6.18
Thank you to bugbunny-research for discovering and reporting this issue.