## Security Flaw in FileConfig: Unbounded MaxSizeMB, MaxBackups, MaxAgeDays Risk Disk Exhaustion DoS
A critical security oversight in a logging configuration system creates a direct path to disk exhaustion and denial-of-service (DoS). The `FileConfig` struct's fields—`MaxSizeMB`, `MaxBackups`, and `MaxAgeDays`—lack any upper-bound validation. While zero or negative values are safely defaulted, the system silently accepts arbitrarily large positive values. An attacker or a simple misconfiguration can set `MaxSizeMB` to `math.MaxInt`, allowing a single log file to grow uncontrollably until it consumes all available storage, crashing the host system.

The vulnerability stems from the `NewFileOutput` function, which fails to enforce maximum limits on these parameters. This flaw is particularly notable because the existing `Config` type in the same codebase already demonstrates the correct pattern with upper-bound validation for fields like `MaxBufferSize` and `MaxDrainTimeout`. The inconsistency suggests a missing security guardrail that was identified during a review of PR #42. The attack vector is any caller with control over the `FileConfig` values, which could be a misconfigured YAML file, an untrusted external configuration source, or internal code that passes unvalidated user input directly to the logging output.

The severity is assessed as MEDIUM, as exploitation requires the attacker to control the configuration input. However, the potential impact is a complete system DoS through resource exhaustion. This vulnerability highlights a common but dangerous pattern where input validation focuses on lower bounds and defaults while ignoring catastrophic upper limits, leaving production systems exposed to a simple, high-impact attack.
---
- **Source**: GitHub Issues
- **Sector**: The Lab
- **Tags**: security, vulnerability, denial-of-service, configuration, logging
- **Credibility**: unverified
- **Published**: 2026-03-26 13:27:29
- **ID**: 35506
- **URL**: https://whisperx.ai/en/intel/35506