# A resource ceiling on every remote input, and compliance that actually persists

> On main since rc2: A resource ceiling on every remote input, and compliance that actually persists.

Source: https://kern-lang.eu/releases/resource-ceilings-and-compliance

On main since rc2

## Release notes

A sustained hardening wave gave the runtime a ceiling wherever a remote peer chooses the cost. HTTP gained a total request deadline and a connection admission cap; JSON parsing caps nesting depth, which was a remote unauthenticated stack overflow; chunked decoding is linear rather than quadratic; Redis replies, OCI registry bodies and HTTP/2 bodies are all bounded; a `Content-Length` remote abort and a Zip Slip arbitrary write are closed; a TLS file-descriptor use-after-free is refcounted; a 32-bit size wrap in gRPC decode is fixed; three TLS `WANT_READ` busy-spins and a blocking connect inside the global pool mutex are gone; and the SSRF and egress allowlist now applies at _every_ dialer rather than one.

A separate pass drew on twenty CVEs from 2024 to 2026 plus the CWE Top 25 and added `net.request_guard` for per-request body, URI, header and query-parameter bounds, a per-key rate limiter with fail-closed overflow, and a path sanitizer that rejects URL-encoded traversal (`%2e`, `%2f`, `%5c`, `%00`) rather than only literal `..`. Two detector gaps were found and closed on a later sweep: `csrf_origin_check` used a substring test, so `https://example.com.attacker.net` passed the same-origin fallback, and the SSRF guard only recognised dotted-decimal IPv4, so `0177.0.0.1`, `2130706433`, `0x7f000001` and `127.1` all walked past a `127.` prefix check; both now normalise and match exactly.

The most consequential finding was not an exploit. An adopter audit found that `std.compliance` was **twenty functions of pure string formatting with zero persistence**: calling `audit_entry()` made a GDPR obligation feel discharged while the string vanished if you dropped it. It is now backed by the same tamper-evident chain the AI Act log uses, keyed-HMAC-SHA256-linked, fsync'd and append-only, with `compliance_audit_verify` returning true only if every record still links, which is the operator-verifiable proof a DORA Art.

17 or NIS2 Art. 23 examiner asks for. Editing one field in a written record breaks the chain and verification catches it. The rest of the compliance surface was audited and confirmed genuine, and `audit_entry` survives as an explicitly labelled formatter that persists nothing.