{"record":{"id":"a37c21d78cf7ea8e","repo":"PrefectHQ/fastmcp","slug":"response-too-large-exceeded-max-size-bytes","errorCode":null,"errorMessage":"Response too large: exceeded {max_size} bytes","messagePattern":"Response too large: exceeded (.+?) bytes","errorType":"exception","errorClass":"SSRFFetchError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/ssrf.py","lineNumber":517,"sourceCode":"                if content_length:\n                    try:\n                        size = int(content_length)\n                        if size > max_size:\n                            raise SSRFFetchError(\n                                f\"Response too large: {size} bytes (max {max_size})\"\n                            )\n                    except ValueError:\n                        pass\n\n                # Stream the response and enforce size limit during download\n                chunks = []\n                total = 0\n                async for chunk in response.aiter_bytes():\n                    if time.monotonic() - start_time > overall_timeout:\n                        raise SSRFFetchError(f\"Overall timeout exceeded: {url}\")\n                    total += len(chunk)\n                    if total > max_size:\n                        raise SSRFFetchError(\n                            f\"Response too large: exceeded {max_size} bytes\"\n                        )\n                    chunks.append(chunk)\n\n                return SSRFFetchResponse(\n                    content=b\"\".join(chunks),\n                    status_code=response.status_code,\n                    headers=dict(response.headers),\n                )\n\n        except httpx2.TimeoutException as e:\n            last_error = e\n            continue\n        except httpx2.RequestError as e:\n            last_error = e\n            continue\n\n    if last_error is not None:","sourceCodeStart":499,"sourceCodeEnd":535,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/ssrf.py#L499-L535","documentation":"Even without a Content-Length header, ssrf_safe_fetch_response counts bytes as they stream in and raises SSRFFetchError if the accumulated total exceeds max_size (default 5120). This enforces the size cap against servers that omit or lie about Content-Length, and partial content is discarded.","triggerScenarios":"Server sends chunked transfer-encoding (no Content-Length) and the body exceeds max_size while aiter_bytes() iterates; server lies with a small Content-Length while sending more data.","commonSituations":"Fetching a large JSON/HTML document with the 5 KB default cap; a hostile endpoint deliberately streaming oversized bodies; misconfigured endpoint returning an error page larger than the limit.","solutions":["Raise max_size to fit the legitimate response (e.g. max_size=131072).","Verify the endpoint returns the intended compact document, not an error/HTML page.","Check whether a proxy is inflating or wrapping the response body.","Catch SSRFFetchError and surface the size-limit mismatch in application logs."],"exampleFix":"// before\nresp = await ssrf_safe_fetch_response(url)  # streamed 8KB body > 5120 default\n// after\nresp = await ssrf_safe_fetch_response(url, max_size=128 * 1024)","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    resp = await ssrf_safe_fetch_response(url, max_size=131072)\nexcept SSRFFetchError as e:\n    if \"too large\" in str(e):\n        logger.warning(\"%s exceeded size cap\", url)\n        return None\n    raise","preventionTips":["Raise max_size only to a justified bound for the document format","Remember the cap applies to actual streamed bytes, not just Content-Length","Log the total when the cap trips to tune the limit"],"tags":["network","ssrf","size-limit","streaming"],"backgroundTag":"response-too-large","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}