From 7a16129bfc07dbdc2fa52b99d2985c1bc0ea12e2 Mon Sep 17 00:00:00 2001 From: Ariel Leyva Date: Sat, 4 Apr 2026 03:11:50 -0400 Subject: [PATCH] fix(tus): reject negative upload-length to prevent inconsistent cache entry (#5876) --- http/tus_handlers.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/http/tus_handlers.go b/http/tus_handlers.go index 0b7bcbb4..31245a34 100644 --- a/http/tus_handlers.go +++ b/http/tus_handlers.go @@ -105,7 +105,7 @@ func tusPostHandler(cache UploadCache) handleFunc { } uploadLength, err := getUploadLength(r) - if err != nil { + if err != nil || uploadLength < 0 { return http.StatusBadRequest, fmt.Errorf("invalid upload length: %w", err) }