[BUG] Token-limiter BodyWriter unboundedly buffers the entire (non-gzip) response for the fallback scan

[Aias00]

• severity: Medium
• files: shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-token-limiter/src/main/java/org/apache/shenyu/plugin/ai/token/limiter/AiTokenLimiterPlugin.java:349-392
• description: appendResponse writes every processed chunk into a BodyWriter backed by an unbounded ByteArrayOutputStream, solely so the doFinally fallback can regex-scan the full output if per-chunk parsing missed completion_tokens. For a long non-gzip SSE stream this accumulates the entire response in heap with no cap.
• impact: A large streaming AI response can exhaust gateway heap even without gzip.
• suggested_fix: Cap the buffered bytes (ring/last-N-KB buffer); only the final usage chunk is needed.
• confidence: Medium
• related_existing: none — SEC-9 is the gzip Inflater path; this is a distinct OOM vector from unbounded plain-byte accumulation.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/06-medium-tiers.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] Token-limiter BodyWriter unboundedly buffers the entire (non-gzip) response for the fallback scan
• Link: [BUG] Token-limiter BodyWriter unboundedly buffers the entire (non-gzip) response for the fallback scan #6758

Please review when you have time. Thank you! 🙏