Evidence · DiggingBeagle record
Agent Router controller OAuth metadata memory exhaustion
Advisory: unbounded OAuth metadata reads caused a shared controller to exhaust memory.
- Source role
- primary disclosure
Evidence record
Advisory: unbounded OAuth metadata reads caused a shared controller to exhaust memory.
Claim-level citations (2)
- supportsOversized OAuth metadata could crash Agent Router shared reconciliation: In the isolated Kubernetes reproduction, a 40 MiB metadata response killed a 160 MiB controller three times and delayed a different namespace's route reconciliation by 43 seconds.
Summary; Observed Results; Conclusion
- supportsOversized OAuth metadata could crash Agent Router shared reconciliation: An MCPRoute-controlled OAuth metadata endpoint could return a large JSON response and exhaust the shared Agent Router controller memory because the response used unbounded reading.
Summary; Proof-of-concept and 1.2.1 remediation