Unbounded client-controlled values reached the 2000-entry admin log ring
buffer and its SSE fan-out, letting an unauthenticated burst pin large amounts
of heap. A boundRequestID middleware now drops an inbound X-Request-Id over
128 bytes or outside printable ASCII, so chi generates its own, and the logged
request path is capped at 256 bytes. Both hunks are needed: a raw-socket probe
showed a 1MB r.URL.Path reaches the same sink independently of the header.
Verified by a panel of agents; an unpatched-tree reproduction fails 3 of the 4
added tests with the attacker bytes visible in the log record. UUID, 32-hex,
W3C traceparent and chi's own generated id format all still pass unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
