fix: remote-input DoS hardening (unbounded allocation, panics, missing limits)#514

Merged

varex83 merged 13 commits into

mainfrom

bohdan/remote-input-dos-hardening

Jul 7, 2026

Commits on Jul 1, 2026

fix(core): make SemVer::parse fail-closed on integer overflow

varex83agent
and
varex83
committed
fix(cluster): cap num_validators for legacy definitions

varex83agent
and
varex83
committed
fix(ssz): reject all-zero final byte in parse_bitlist

varex83agent
and
varex83
committed
fix(p2p): bound PeerStore inactive_peers and peer_addresses growth

varex83agent
and
varex83
committed
fix(p2p): gate identify address writes to known peers and cap count

varex83agent
and
varex83
committed
fix(relay-server): restore rate limiters and add per-IP reservation cap

varex83agent
and
varex83
committed
fix(eth2util): cap concurrent keystore decryption to 10 workers

varex83agent
and
varex83
committed
fix(consensus): cap justification count per inbound QBFT message

varex83agent
and
varex83
committed
fix: bound HTTP response bodies and add per-request timeouts

varex83agent
and
varex83
committed
fix: bound peer-supplied metric label length

varex83agent
and
varex83
committed
style: apply rustfmt to DoS-hardening changes

varex83agent
and
varex83
committed

Commits on Jul 3, 2026

Merge remote-tracking branch 'origin/main' into bohdan/remote-input-dos-hardening
varex83agent
committed

Commits on Jul 6, 2026

chore(deps): bump quick-xml to 0.41 to fix RUSTSEC advisory

varex83agent
and
varex83
committed