Fix Unrestricted Resource Consumption in Bottle
Bottle's default configuration is a DoS playground. Without explicit limits on request body size or memory buffers, an attacker can exhaust server memory or disk space with a single bloated POST request. If you aren't capping `MEMFILE_MAX` or validating `Content-Length`, your app is one `curl` command away from an OOM-kill.
The Vulnerable Pattern
from bottle import route, request, run@route(‘/upload’, method=‘POST’) def do_upload(): # VULNERABLE: Implicitly trusts the request size. # request.body.read() will attempt to buffer the entire payload into RAM. data = request.body.read() return {‘status’: ‘received’, ‘size’: len(data)}
run(host=‘0.0.0.0’, port=8080)
The Secure Implementation
The vulnerability stems from the framework's willingness to consume as much data as the client sends. In the vulnerable version, `request.body.read()` reads the entire input stream into memory. An attacker can send a multi-gigabyte POST request to exhaust the server's RAM. The secure fix involves three layers: globally configuring `BaseRequest.MEMFILE_MAX` to limit Bottle's internal `BytesIO` buffer, manually validating the `Content-Length` header to reject oversized payloads before processing, and passing an explicit size limit to the `.read()` method to prevent stream-based exhaustion.
from bottle import route, request, run, BaseRequest, HTTPError1. Set global memory buffer limit (Default is 100KB, let’s enforce 1MB)
BaseRequest.MEMFILE_MAX = 1024 * 1024
@route(‘/upload’, method=‘POST’) def do_upload(): # 2. Validate Content-Length header before reading body try: content_length = int(request.get_header(‘Content-Length’, 0)) except ValueError: raise HTTPError(400, ‘Invalid Content-Length’)
if content_length > BaseRequest.MEMFILE_MAX: raise HTTPError(413, 'Payload Too Large') # 3. Use a limit when reading from the stream data = request.body.read(BaseRequest.MEMFILE_MAX) return {'status': 'securely_processed', 'size': len(data)}
run(host=‘0.0.0.0’, port=8080)
Your Bottle API
might be exposed to Unrestricted Resource Consumption
74% of Bottle apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.