Skip to content

Bound concurrent client connections to prevent DoS (fixes #3) - #12

Open
KingUdo wants to merge 3 commits into
mainfrom
issue-3-bounded-connection-threads
Open

KingUdo wants to merge 3 commits into
mainfrom
issue-3-bounded-connection-threads

Conversation

@KingUdo

@KingUdo KingUdo commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

  • Introduced MAX_CONCURRENT_CLIENTS (default: 100, configurable via environment variable).
  • Enforced a concurrency limit in start_telnet_server using threading.BoundedSemaphore.
  • If the maximum connection limit is reached, incoming connections are rejected immediately with a friendly message (Server busy. Connection closed.) and closed, preventing unbounded thread spawning and memory/OS resource exhaustion.
  • Ensured the semaphore is released in the finally block of handle_client.
  • Added unit test test_handle_client_releases_semaphore to verify resource cleanup.
  • Fixes Denial of Service risk: Unbounded thread spawning on client connections #3.

Testing

Ran pytest across the whole suite:

============================== 19 passed in 3.17s ==============================

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Denial of Service risk: Unbounded thread spawning on client connections

1 participant