{"record":{"id":"aef376194febce51","repo":"PrefectHQ/fastmcp","slug":"response-too-large-size-bytes-max-max-size","errorCode":null,"errorMessage":"Response too large: {size} bytes (max {max_size})","messagePattern":"Response too large: (.+?) bytes \\(max (.+?)\\)","errorType":"exception","errorClass":"SSRFFetchError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/ssrf.py","lineNumber":503,"sourceCode":"                    \"GET\",\n                    target.url,\n                    headers=headers,\n                    extensions=extensions,\n                ) as response,\n            ):\n                if time.monotonic() - start_time > overall_timeout:\n                    raise SSRFFetchError(f\"Overall timeout exceeded: {url}\")\n\n                if response.status_code not in expected_statuses:\n                    raise SSRFFetchError(f\"HTTP {response.status_code} fetching {url}\")\n\n                # Check Content-Length header first if available\n                content_length = response.headers.get(\"content-length\")\n                if content_length:\n                    try:\n                        size = int(content_length)\n                        if size > max_size:\n                            raise SSRFFetchError(\n                                f\"Response too large: {size} bytes (max {max_size})\"\n                            )\n                    except ValueError:\n                        pass\n\n                # Stream the response and enforce size limit during download\n                chunks = []\n                total = 0\n                async for chunk in response.aiter_bytes():\n                    if time.monotonic() - start_time > overall_timeout:\n                        raise SSRFFetchError(f\"Overall timeout exceeded: {url}\")\n                    total += len(chunk)\n                    if total > max_size:\n                        raise SSRFFetchError(\n                            f\"Response too large: exceeded {max_size} bytes\"\n                        )\n                    chunks.append(chunk)\n","sourceCodeStart":485,"sourceCodeEnd":521,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/ssrf.py#L485-L521","documentation":"ssrf_safe_fetch_response enforces a max_size limit (default 5120 bytes) using the Content-Length response header before downloading. If the declared body exceeds the cap, SSRFFetchError is raised immediately without streaming the body. This prevents a malicious host from announcing or delivering arbitrarily large payloads during SSRF-guarded fetches.","triggerScenarios":"Fetching a URL whose server sends Content-Length larger than max_size (e.g. fetching a large page with default 5 KB cap); a hostile endpoint deliberately returning a huge declared size to probe the guard.","commonSituations":"Pointing fetch at an HTML page instead of a small JSON metadata document; CIMD metadata that includes extra fields pushing past 5 KB; proxies adding content that inflates the body.","solutions":["Raise max_size to accommodate the expected document (e.g. max_size=65536).","Confirm the URL points to a compact JSON metadata document, not an HTML page.","If the host lies about Content-Length, note the streaming path (error 385) also caps actual bytes, so both header and streamed sizes must fit.","Catch SSRFFetchError and report/document the size limit to callers."],"exampleFix":"// before\nresp = await ssrf_safe_fetch_response(url)  # max_size=5120 default\n// after\nresp = await ssrf_safe_fetch_response(url, max_size=64 * 1024)","handlingStrategy":"validation","validationCode":"# pre-flight size check\nhead = await client.head(url)\ncl = int(head.headers.get(\"content-length\", \"0\"))\nassert cl <= max_size, f\"body {cl}B exceeds max_size {max_size}B\"","typeGuard":null,"tryCatchPattern":"try:\n    resp = await ssrf_safe_fetch_response(url, max_size=65536)\nexcept SSRFFetchError as e:\n    if \"Response too large\" in str(e):\n        raise PayloadTooLarge(url) from e\n    raise","preventionTips":["Set max_size to the documented upper bound of the payload type","Point fetches at compact JSON endpoints, not HTML pages","Keep the default 5KB cap unless the format justifies more"],"tags":["network","ssrf","size-limit","http"],"backgroundTag":"response-too-large","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}