---
id: 631e14a9-8678-4817-a87b-c6c0d4e76bbd
title: 'serve: static GET/HEAD buffers whole file in RAM (OOM on large raw files)'
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T17:24:52.347086939Z
updated: 2026-10-27T17:45:41.629782227Z
---
## What

Static file responses buffer the whole file into memory before sending, for **GET and HEAD**:

- `src/serve.rs:695` — `std::fs::read(&dest)` happens before the method check.

Raw blobs are unbounded (build streams any size to `raw/`), so `/raw/big.bin` allocates the full size per request. With `MAX_CONNS=64`, a handful of large files can OOM the process.

## Reproduced

64 MB blob, `VmHWM` before/after one request:

```
VmHWM:  70,540 kB
```

(process baseline ~5 MB). HEAD performs the same read.

## Impact

Remote OOM/DoS on `hu13 serve`; the streaming path already exists for git packs (`respond_file`) but is not used for static assets.

## Fix

- Use `respond_file` (or equivalent streaming with `Content-Length` from `stat`) for static files.
- HEAD: stat only, send headers, no body.
- Keep the method check before opening/reading the file.
- Test: large raw file, assert a bounded read/streamed response and HEAD without buffering.