Finding
fetch_xml() (line 51, identical in torznab.rs) returns cf_proxy.get(...).body directly on the cf_bypass=true branch, skipping read_body_bounded (the only max_body_bytes enforcement point), and ByparrProxy::get reads the whole response via response.json() with no cap — so for any cf_bypass indexer the configured max_response_body_bytes is a no-op and concurrent oversized bodies drive unbounded memory growth.
Evidence
crates/zetesis/src/client/newznab.rs:51 (identical in torznab.rs). Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
For any Cloudflare-bypassed indexer, the configured maximum response body size is completely unenforced, letting concurrent oversized responses grow process memory without bound.
Desired correction
Enforce the max_body_bytes cap inside ByparrProxy::get (bounded streaming read / Content-Length check before buffering), or route the cf_bypass branch through read_body_bounded so both paths share one enforcement point.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
fetch_xml() (line 51, identical in torznab.rs) returns cf_proxy.get(...).body directly on the cf_bypass=true branch, skipping read_body_bounded (the only max_body_bytes enforcement point), and ByparrProxy::get reads the whole response via response.json() with no cap — so for any cf_bypass indexer the configured max_response_body_bytes is a no-op and concurrent oversized bodies drive unbounded memory growth.
Evidence
crates/zetesis/src/client/newznab.rs:51 (identical in torznab.rs). Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
For any Cloudflare-bypassed indexer, the configured maximum response body size is completely unenforced, letting concurrent oversized responses grow process memory without bound.
Desired correction
Enforce the max_body_bytes cap inside ByparrProxy::get (bounded streaming read / Content-Length check before buffering), or route the cf_bypass branch through read_body_bounded so both paths share one enforcement point.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.