Skip to content

fix: bound HTTPServer request resources - #2333

Merged
zeitlinger merged 3 commits into
mainfrom
agent/bound-httpserver-resources
Aug 26, 2026
Merged

fix: bound HTTPServer request resources#2333
zeitlinger merged 3 commits into
mainfrom
agent/bound-httpserver-resources

Conversation

@zeitlinger

Copy link
Copy Markdown
Member

Summary

  • use a fixed-size default executor with a bounded queue and non-blocking rejection
  • close rejected authenticated request bodies instead of draining an unbounded body
  • close rejected exchanges after sending HTTP 403

This is the focused replacement for the #2284 portion of #2297.

Fixes #2284

Ongoing discussion

None currently. Earlier review feedback about preserving default concurrency and closing rejected exchanges is incorporated here.

Validation

  • mise run lint:fix
  • mise run build
  • ./mvnw test -pl prometheus-metrics-exporter-httpserver -Dcoverage.skip=true -Dcheckstyle.skip=true

@zeitlinger
zeitlinger marked this pull request as ready for review July 23, 2026 11:19
@zeitlinger

Copy link
Copy Markdown
Member Author

@jaydeluca can you take a look?

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger force-pushed the agent/bound-httpserver-resources branch from 5142ece to e951334 Compare August 26, 2026 07:43
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger force-pushed the agent/bound-httpserver-resources branch from e951334 to d8af483 Compare August 26, 2026 07:44
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger merged commit 33ec556 into main Aug 26, 2026
23 checks passed
@zeitlinger
zeitlinger deleted the agent/bound-httpserver-resources branch August 26, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# Security Report: Thread Pool Exhaustion via Slow Clients (Slowloris-style DoS) in prometheus/client_java HTTPServer

2 participants