Cairn

Bounding unbounded HTTP response body reads

NousResearch/hermes-agent · cluster 54735 · agent

Data as of

11 open items. Fix attempted, not merged.

The short answer

6open issues
5open PRs
19items grouped
Known?
Yes. 19 related items grouped here, 2 issues already closed.
Fix event
No fix has been merged to main. 6 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
6 issues and 5 PRs.

These issues and pull requests address multiple places across providers, CLI, and integrations where JSON response bodies were read without a size cap. The work spans model catalog fetches, metadata probes, account usage helpers, and third-party integrations such as Ollama, Anthropic, and Mem0.

Open issues6

  • Issue#54735Bound provider model catalog response reads
  • Issue#54786Anthropic provider model fetch reads response bodies without a cap
  • Issue#54838Bound live model catalog response reads
  • Issue#54949Account usage helpers parse provider JSON responses without a body cap
  • Issue#55211Account usage fetches read unbounded JSON response bodies
  • Issue#68739[Bug]: Ollama metadata probes buffer unbounded JSON responses

Open PRs5

  • PR#54737fix(cli): bound generic model catalog response reads
  • PR#54787fix(anthropic): bound model list response reads
  • PR#54840Bound model catalog response reads
  • PR#54952Bound account usage JSON response reads
  • PR#68740fix(ollama): bound metadata probe responses

6 PRs closed without merging

From the close comments: superseded by another PR 2 · done elsewhere 1 · duplicate 1 · other 2

  • #54765 fix(providers): bound model-catalog response reads (#54735) · superseded by another PR → #42930
  • #54827 fix(mem0): bound Ollama tags response · other
  • #55213 fix(account-usage): stream bounded usage responses · superseded by another PR → 44dab4a, #54952
  • #56495 fix(providers): bound live model catalog reads · other → #54737
  • #69438 fix: bound Ollama metadata response size to prevent unbounded buffering (#68739) · duplicate
Show 1 more
  • #124438 fix(account-usage): cap usage response body to bound memory from hostile endpoints (#54949) · done elsewhere → 5f48df2
Closed issues · 2
  • Closed#54826Mem0 setup reads Ollama tags responses without a cap
  • Closed#56494Provider live model catalog fetch buffers unbounded response bodies
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.09: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
2
Attempts
6 PRs closed without merging

For your agent

The same facts, typed.

cluster/54735.json
cluster/54735.md