{
  "id": 2204591,
  "title": "The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS in py-libp2p",
  "url": "https://urgent.news/2026/08/20/the-sdp-endpoint-that-trusted-its-callers-fixing-a-memory",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-20T18:56:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/yashksaini/the-sdp-endpoint-that-trusted-its-callers-fixing-a-memory-amplification-dos-in-py-libp2p-3g2e"
  },
  "original_language": "en",
  "account": "The py-libp2p project, which implements the libp2p peer-to-peer networking stack for Python, contains a web-based Transport called WebRTC-Direct. This allows two peers to connect directly without a certificate authority, using multiaddr hashes and DTLS handshakes. Before establishing an encrypted connection, the two peers exchange SDP offer/answer packets. Until the STUN-based listener is implemented (issue #1352), a minimal dev harness in py-libp2p handles this exchange via an HTTP server listening on the /sdp endpoint.\n\nThe vulnerability was found in the POST /sdp handler, which took the caller's Content-Length header and buffered the exact number of bytes without any upper bound. The body, headers, and decoded header values were all stored in memory, leading to a memory-amplification Denial of Service (DoS) attack. The attacker could control the size of the request body and headers, causing the memory usage to grow arbitrarily large. The handler also lacked a timeout, enabling an attacker to continuously send header lines and never terminate the loop.\n\nA reproduction harness was built to test the vulnerability, showing that a malicious 4 MiB request could cause the memory usage to peak at 1,113 MiB. After applying the fix, the memory usage remained minimal, even with a 1 GiB malicious request. The fix introduces three bounded constants: _MAX_SDP_BODY_SIZE (32 KiB), _MAX_HEADER_LINES (64), and _MAX_HEADER_BYTES (8 KiB) to prevent memory-amplification DoS attacks on the /sdp endpoint.",
  "summary": "This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview py-libp2p is the Python implementation of libp2p — the peer-to-peer networking stack that underpins IPFS, Filecoin, and Ethereum-class nodes. I've been working on its WebRTC-Direct transport, which lets two peers connect without a certificate authority: the peer's multiaddr carries a hash of its…",
  "key_points": [
    "py-libp2p's /sdp endpoint handled SDP offer/answer packets without certificate authority",
    "POST /sdp handler buffered request body and headers in memory without bounds",
    "Fix introduced bounded constants to prevent memory-amplification DoS"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}