Summary
AppEnv.CreateRequestContext in controller/env/appenv.go calls io.ReadAll(r.Body) to buffer the entire HTTP request body into memory before any authentication or authorization check is performed. This function is invoked on every inbound request across the client, management, and fabric-management web APIs. Unauthenticated endpoints such as /edge/client/v1/enroll are reachable without credentials and carry no per-request byte-size cap, allowing a network attacker to drive substantial memory growth by sending parallel large-body requests, potentially causing an out-of-memory crash in the controller.
Package
ziti
Affected Versions
2.0.x-v2.0.1 v1.6.x-v1.6.17
Patched Versions
2.0.2, 1.6.18
Thank you to bugbunny-research for discovering and reporting this issue.