Reassemble multiline replies in linear time
fix(smtp-connection): reassemble multiline replies in linear time
Reassemble multiline replies in linear timef2d82f-fix-reassemble-multiline-replies-in-linear-time-cve-2026-110867fixreassemble multiline replies linear time smtp
Committed by andris9
commit message
fix(smtp-connection): reassemble multiline replies in linear time
_onData appended every continuation line to the last response queue entry and
then re-scanned that entry to find its last line, re-flattening a string that
grows with the reply. A hostile peer streaming continuation lines drove the
reassembly quadratic before the client had authenticated: 128k lines took ~15s
of blocked event loop. The line just appended is the entry's last line, so it
alone decides whether the reply is still partial.
A chunk carrying no line break was also concatenated onto the remainder and the
whole remainder re-split on every chunk, so a line the peer never terminated
went quadratic the same way: 1MB delivered one byte at a time took ~60s. Such a
chunk now only extends the remainder, which is left unflattened.
Both buffers are bounded by the new maxResponseSize option, 1MB by default, and
the bound is checked as each line lands so it does not depend on how the peer
split its bytes into chunks. A peer that never completes a reply is dropped
with EPROTOCOL instead of buffering without limit.
Refs GHSA-4g23-2xm8-66gc
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01PLQDdd6Sa67zKQTrSANgTbEditor assessment
This commit patches CVE-2026-110867. Exemplary. The subject states both the fix and the complexity guarantee, and the body proves the problem with measurements: 128k continuation lines took ~15s of blocked event loop, and 1MB delivered a byte at a time took ~60s. It then explains why the last appended line alone decides partiality, why the remainder must stay unflattened, and how maxResponseSize bounds both buffers with EPROTOCOL instead of unbounded buffering. Clear, teaching and complete. Formally the header is clean, the smtp-connection scope is precise, and the body is separated and readable; no structural improvement is needed.