spring-projects/spring-ai · error · java.lang.SecurityException

Media URL response exceeds maximum allowed size of bytes

Error message

Media URL response exceeds maximum allowed size of  bytes

What it means

MediaFetcher streams the bytes of a user-supplied media URL and enforces a hard cap (maxBytes) on how much it will read. As soon as the cumulative bytes read exceed the limit, it aborts and throws this SecurityException instead of buffering an arbitrarily large response. It protects the JVM from memory exhaustion (denial of service) when a remote URL points at a very large or endless resource.

Source

Thrown at models/spring-ai-bedrock-converse/src/main/java/org/springframework/ai/bedrock/converse/api/MediaFetcher.java:198

					return true;
				}
			}
			else if (normalizedHost.equals(normalizedAllowed)) {
				return true;
			}
		}
		return false;
	}

	private static byte[] readWithSizeLimit(InputStream inputStream, int maxBytes) throws IOException {
		ByteArrayOutputStream output = new ByteArrayOutputStream();
		byte[] buffer = new byte[8192];
		int totalRead = 0;
		int bytesRead;
		while ((bytesRead = inputStream.read(buffer)) != -1) {
			totalRead += bytesRead;
			if (totalRead > maxBytes) {
				throw new SecurityException(
						"Media URL response exceeds maximum allowed size of " + maxBytes + " bytes");
			}
			output.write(buffer, 0, bytesRead);
		}
		return output.toByteArray();
	}

	private static RestClient createSsrfSafeRestClient() {
		Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
			.register("http", new SsrfBlockingPlainSocketFactory())
			.register("https", new SsrfBlockingSSLSocketFactory(SSLConnectionSocketFactory.getSocketFactory()))
			.build();

		PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(
				socketFactoryRegistry, null, null, null, null, new SsrfSafeDnsResolver(), null);
		connectionManager.setDefaultConnectionConfig(ConnectionConfig.custom()
			.setConnectTimeout(Timeout.ofSeconds(DEFAULT_CONNECT_TIMEOUT_SECONDS))
			.setSocketTimeout(Timeout.ofSeconds(DEFAULT_SOCKET_TIMEOUT_SECONDS))

View on GitHub (pinned to 98a7beda4f)

Solutions

1. Serve or point to a smaller media file that fits within the configured maxBytes limit (compress/resize the image, or use a trimmed PDF).
2. Raise the size limit if legitimately large media is expected, by configuring MediaFetcher with a larger maxBytes value when constructing it.
3. Verify the URL actually resolves to the intended media and not an oversized default/landing response (e.g. an HTML error page with a huge body).
4. Catch SecurityException around the model call and return a clear validation message asking the user to supply smaller media.

Example fix

// before
Media media = new Media(MimeTypeUtils.IMAGE_JPEG, new URL("https://example.com/huge-40mb-image.png"));
// after
Media media = new Media(MimeTypeUtils.IMAGE_JPEG, new URL("https://example.com/resized-4mb-image.jpg"));
// or raise the cap:
// MediaFetcher fetcher = MediaFetcher.withMaxBytes(64 * 1024 * 1024);

// Java: pre-check remote media size via HEAD before including it
HttpURLConnection c = (HttpURLConnection) mediaUrl.openConnection();
c.setRequestMethod("HEAD");
long len = c.getContentLengthLong();
long MAX = 20L * 1024 * 1024; // match your MediaFetcher maxBytes
if (len > MAX) {
    throw new IllegalArgumentException("Media URL body " + len + " bytes exceeds limit " + MAX);
}

try {
    model.call(prompt);
} catch (SecurityException e) {
    if (e.getMessage().contains("exceeds maximum allowed size")) {
        // reject media, ask user for a smaller file
    } else { throw e; }
}

When it happens

Trigger: Calling Bedrock Converse model APIs that include a Media (image/document) whose URL, when fetched via MediaFetcher.fetch/readWithSizeLimit, returns more than the configured maxBytes (default limit) of body bytes before EOF.

Common situations: Pointing media URLs at multi-hundred-MB files (e.g. raw video, TIFF scans) instead of reasonable images/PDFs; a misconfigured or hostile endpoint returning an unbounded/huge body; proxies that ignore Range requests and return the full object; limits tightened by a newer library version so previously working media now trips the cap.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• URL is not valid under strict validation rules:
• Unsupported URL protocol:
• Media URL response exceeds maximum allowed size of bytes:
• Invalid video content type:
• Failed to read media data from URL:

AI-assisted analysis of spring-projects/spring-ai@98a7beda4f (2026-09-11). Data as JSON: /api/errors/11d9583ebd35caf1. Report an issue: GitHub.