Limit HTTP header count and size

[russellb]

Fixes GHSA-rxc4-3w6r-4v47

Signed-off-by: Taneem Ibrahim [email protected]
Co-authored-by: Russell Bryant [email protected]
Signed-off-by: Russell Bryant [email protected]

[gemini-code-assist]

Code Review

This pull request addresses a security vulnerability (GHSA-rxc4-3w6r-4v47) by introducing limits on HTTP header count and size to prevent header abuse attacks. It adds new command-line arguments to configure these limits, with safe defaults. The changes are well-structured, introducing constants for the default values and applying them in the uvicorn server configuration. The implementation appears correct and effectively mitigates the reported vulnerability. I have no major concerns with this change.

[github-actions]

👋 Hi! Thank you for contributing to the vLLM project.

💬 Join our developer Slack at https://slack.vllm.ai to discuss your PR in #pr-reviews, coordinate on features in #feat- channels, or join special interest groups in #sig- channels.

Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which starts running only a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of those by going to your fastcheck build on Buildkite UI (linked in the PR checks section) and unblock them. If you do not have permission to unblock, ping simon-mo or khluu to add you in our Buildkite org.

Once the PR is approved and ready to go, your PR reviewer(s) can run CI to test the changes comprehensively before merging.

To run CI, PR reviewers can either: Add ready label to the PR or enable auto-merge.

🚀

[simon-mo]

Suggested change

	# Extract header limit options if present
	h11_max_incomplete_event_size = uvicorn_kwargs.pop(
	"h11_max_incomplete_event_size", None)
	h11_max_header_count = uvicorn_kwargs.pop("h11_max_header_count", None)
	# Set safe defaults if not provided
	if h11_max_incomplete_event_size is None:
	h11_max_incomplete_event_size = H11_MAX_INCOMPLETE_EVENT_SIZE_DEFAULT
	if h11_max_header_count is None:
	h11_max_header_count = H11_MAX_HEADER_COUNT_DEFAULT
	config = uvicorn.Config(app, **uvicorn_kwargs)
	# Set header limits
	config.h11_max_incomplete_event_size = h11_max_incomplete_event_size
	config.h11_max_header_count = h11_max_header_count
	# Set header limits
	config.h11_max_incomplete_event_size = uvicorn_kwargs.pop(
	"h11_max_incomplete_event_size", H11_MAX_INCOMPLETE_EVENT_SIZE_DEFAULT)
	config.h11_max_header_count = uvicorn_kwargs.pop(
	"h11_max_header_count", H11_MAX_HEADER_COUNT_DEFAULT)

[russellb]

I think this will break if the options are in uvicorn_kwargs but set to None. The previous code would ensure we overwrote the value if it was either not present or was set to None.