Skip to content

csaf_downloader - memory leak#743

Open
adulau wants to merge 2 commits into
gocsaf:mainfrom
vulnerability-lookup:main
Open

csaf_downloader - memory leak#743
adulau wants to merge 2 commits into
gocsaf:mainfrom
vulnerability-lookup:main

Conversation

@adulau

@adulau adulau commented Jul 7, 2026

Copy link
Copy Markdown

Improve CSAF downloader resource management by limiting memory retention and closing HTTP response bodies on failed requests. Advisory data is now buffered locally for each download, preventing long-running workers from retaining the largest previously processed advisory in memory. This reduces memory pressure during large or continuous feed synchronisations and improves cleanup of network resources on error paths.

@bernhardreiter

Copy link
Copy Markdown
Member

Hi @adulau, thanks for your contribution!

Do you know if this solves or improves #718?

@s-l-teichmann

Copy link
Copy Markdown
Contributor

@adulau Thank you for the contribution.

We are currently addressing the issues around the memory leaks in other branches and PRs. We need to consolidate them first before we can merge this PR.
I expect that the part with the http connection leak is already addressed by these PRs.
The part with the re-used data buffer needs a few more investigations from our side.

@adulau

adulau commented Jul 9, 2026

Copy link
Copy Markdown
Author

You're welcome.

It could be related but we only seen the issue on csaf_downloader used by vulnerability-lookup instances and generating a significant report of issues. If the other PR solves the issue, that's totally fine too.

Do you think this could be merged in the next release? It's becoming a major issue for the large CSAF feeds. Thank you very much.

@bernhardreiter

Copy link
Copy Markdown
Member

Do you think this could be merged in the next release?

Yes, we plan memory consumption improvements for the next release and actively work on it.

It's becoming a major issue for the large CSAF feeds.

If you have some specific testcases for us (best in a new issues if it does not fit #718) we can consider them during the development and in testing before the release. The one from the BSI for instance?

@adulau

adulau commented Jul 9, 2026

Copy link
Copy Markdown
Author

I think a good test case is the one from RedHat. It's pretty large.

@bernhardreiter

Copy link
Copy Markdown
Member

I think a good test case is the one from RedHat. It's pretty large.

Yes, certainly is. BTW, you know that many CSAF files from Redhat are invalid (last time I've looked), https://redhat.atlassian.net/browse/SECDATA-1167

@adulau

adulau commented Jul 10, 2026

Copy link
Copy Markdown
Author

Even from the download perspective, we have many failing for RedHat:

2026-07-07 13:17:26,501 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T13:17:23Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 26171, 'total_failed': 11, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 10, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-07 13:17:53,819 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T12:46:34.110559 will not be retried.
2026-07-07 14:20:24,159 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T14:20:19Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2126, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 0, 'sha512_failed': 0, 'signature_failed': 2}
2026-07-07 14:20:52,152 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T14:17:54.122219 will not be retried.
2026-07-07 15:23:22,586 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T15:23:13Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2143, 'total_failed': 3, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 2, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-07 15:23:53,702 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T15:20:52.551524 will not be retried.
2026-07-07 16:26:24,164 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T16:26:20Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2163, 'total_failed': 17, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 16, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-07 16:26:53,550 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T16:23:54.126670 will not be retried.
2026-07-07 19:32:21,889 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T19:32:14Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 1800, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-07 19:32:49,617 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T19:30:11.855314 will not be retried.
2026-07-07 20:34:30,113 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-07T20:34:20Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2301, 'total_failed': 13, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 13, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-07 20:34:54,826 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-06T20:32:50.087284 will not be retried.
2026-07-08 05:42:22,092 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T05:42:21Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 326, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-08 05:42:46,766 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T05:42:01.912174 will not be retried.
2026-07-08 06:44:17,273 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T06:44:11Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2212, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-08 06:44:47,997 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T06:42:47.243425 will not be retried.
2026-07-08 09:48:42,418 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T09:48:41Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 495, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-08 09:49:08,336 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T09:48:22.411872 will not be retried.
2026-07-08 16:58:23,948 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T16:58:18Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 820, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-08 16:58:55,658 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T16:57:53.935079 will not be retried.
2026-07-08 18:01:36,452 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T18:01:30Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2630, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-08 18:02:03,096 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T17:58:56.135516 will not be retried.
2026-07-08 20:06:39,045 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T20:06:29Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 1739, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-08 20:07:15,489 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T20:05:29.024464 will not be retried.
2026-07-08 21:09:55,928 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T21:09:55Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2572, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-08 21:10:27,271 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T21:07:15.889406 will not be retried.
2026-07-08 22:11:47,793 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-08T22:11:43Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2637, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-08 22:12:17,561 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-07T22:10:27.772296 will not be retried.
2026-07-09 01:17:25,135 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T01:17:21Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 581, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 01:17:50,198 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T01:17:05.124461 will not be retried.
2026-07-09 05:23:01,823 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T05:22:57Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 266, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 05:23:24,164 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T05:22:41.814068 will not be retried.
2026-07-09 06:25:44,777 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T06:25:35Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2731, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 0, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-09 06:26:17,351 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T06:23:24.549735 will not be retried.
2026-07-09 08:29:03,358 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T08:28:57Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 646, 'total_failed': 2, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 2, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 08:29:31,833 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T08:28:23.345223 will not be retried.
2026-07-09 10:31:51,347 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T10:31:48Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 550, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 10:32:17,356 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T10:31:31.339665 will not be retried.
2026-07-09 11:33:47,705 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T11:33:46Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2682, 'total_failed': 8, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 8, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 11:34:34,434 CSAFRedHatImporter WARNING:Unable to connect to redis for csaf_redhat_importer.
2026-07-09 11:38:59,915 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T11:38:53Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 2683, 'total_failed': 7, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 7, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 11:39:23,615 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T11:37:39.824276 will not be retried.
2026-07-09 13:16:14,618 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T13:16:13Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 469, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 1, 'sha512_failed': 0, 'signature_failed': 0}
2026-07-09 13:16:40,562 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T13:15:54.587837 will not be retried.
2026-07-09 15:46:08,403 CSAFRedHat WARNING:A few download failed: {'time': '2026-07-09T15:46:04Z', 'level': 'INFO', 'msg': 'Download statistics', 'succeeded': 884, 'total_failed': 1, 'filename_failed': 0, 'download_failed': 0, 'schema_failed': 0, 'remote_failed': 0, 'sha256_failed': 0, 'sha512_failed': 0, 'signature_failed': 1}
2026-07-09 15:46:38,722 CSAFRedHat WARNING:Partial download failure: files still failing before 2026-07-08T15:45:38.391496 will not be retried.

It's hard to do it right ;-)

@bernhardreiter

Copy link
Copy Markdown
Member

It's hard to do it right ;-)

Quite a few larger CSAF providers will throttle someone who requests many things either too fast or in parallel. Redhat maybe one of them. ;-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants