---

id: 631e14a9-8678-4817-a87b-c6c0d4e76bbd title: 'serve: static GET/HEAD buffers whole file in RAM (OOM on large raw files)' state: closed labels:

• kind:security assignees: [] milestone: null created: 2026-10-27T17:24:52.347086939Z updated: 2026-10-27T17:45:41.629782227Z

---

What

Static file responses buffer the whole file into memory before sending, for GET and HEAD:

• src/serve.rs:695 — std::fs::read(&dest) happens before the method check.

Raw blobs are unbounded (build streams any size to raw/), so /raw/big.bin allocates the full size per request. With MAX_CONNS=64, a handful of large files can OOM the process.

Reproduced

64 MB blob, VmHWM before/after one request:

VmHWM:  70,540 kB

(process baseline ~5 MB). HEAD performs the same read.

Impact

Remote OOM/DoS on hu13 serve; the streaming path already exists for git packs (respond_file) but is not used for static assets.

Fix

• Use respond_file (or equivalent streaming with Content-Length from stat) for static files.
• HEAD: stat only, send headers, no body.
• Keep the method check before opening/reading the file.
• Test: large raw file, assert a bounded read/streamed response and HEAD without buffering.