The WebSocket read loop in internal/rpc/jsonrpc/server.go calls wsc.conn.ReadMessage() without a prior SetReadLimit() call. The gorilla/websocket library defaults to no read limit. HTTP POST requests are properly capped at 4MB via MaxBytesReader, but WebSocket messages have no equivalent bound.
The WebSocket read loop in
internal/rpc/jsonrpc/server.gocallswsc.conn.ReadMessage()without a priorSetReadLimit()call. The gorilla/websocket library defaults to no read limit. HTTP POST requests are properly capped at 4MB viaMaxBytesReader, but WebSocket messages have no equivalent bound.