Root cause: unbounded, server-driven growth
Multiple pieces of state can be driven without limit by the (untrusted) server or by normal long sessions, with no cap, eviction, or backpressure.
Instances already filed
Other observed (not separately filed)
- Telnet subnegotiation buffer grows without bound if
IAC SE never arrives (src/telnet.ts)
FileTransferManager.pendingOffers and the MCP multiline handler map have no per-sender cap
Suggested direction
Cap or evict every server-driven collection; add capped exponential backoff to reconnect; bound the subnegotiation buffer and error out past a limit.
Root cause: unbounded, server-driven growth
Multiple pieces of state can be driven without limit by the (untrusted) server or by normal long sessions, with no cap, eviction, or backpressure.
Instances already filed
MediaServicesound cache has no evictionOther observed (not separately filed)
IAC SEnever arrives (src/telnet.ts)FileTransferManager.pendingOffersand the MCP multiline handler map have no per-sender capSuggested direction
Cap or evict every server-driven collection; add capped exponential backoff to reconnect; bound the subnegotiation buffer and error out past a limit.