Boundary Auditing in Binary Protocols: From FreeRADIUS and ntop/nDPI to AI Agent Primitives

In this technical retrospective from Simply Security Labs (ccsimplyspolit.github.io), we analyze the common thread connecting our coordinated vulnerability disclosures across enterprise network infrastructure (FreeRADIUS, ntop/nDPI, ossrs/srs) and frontier AI agent frameworks (github/gh-aw, czlonkowski/n8n-mcp, Infomaniak/mcp-server-kchat). 1. The Anatomy of Protocol Boundary Failure In native protocol parsers, input data arrives as a raw sequence of bytes over a network socket.

The parser must decode field lengths, advance buffer pointers, and allocate memory structures. If the parser assumes length fields are strictly accurate without verifying them against the total remaining packet buffer, memory corruption occurs. Case Study: FreeRADIUS (GHSA-w6v4-9j58-rv79) In our audit of FreeRADIUS, the world's most widely deployed RADIUS server, we identified a bounds violation where an incoming attribute length could trigger an out-of-bounds pointer calculation during dictionary decoding.

Alan DeKok and the maintainers remediated the issue via commits 1ef1b499f1 and 1c7661e1bd, enforcing strict packet boundary checks before pointer arithmetic. Case Study: ntop/nDPI (GHSA-4x7j-8w5q-5f7w) In ntop/nDPI (the core deep packet inspection library used in enterprise firewalls), malformed network packets with forged segment headers caused a heap read out-of-bounds during protocol classification. The parser read beyond the allocated packet buffer when inspecting variable-length protocol headers.

Case Study: ossrs/srs (GHSA-qr8h-p53p-x564) In Simple Realtime Server (ossrs/srs), real-time media streaming packet framing lacked sufficient bounds verification before payload extraction, leading to memory safety defects under malformed stream frames. 2. The Direct Parallel in AI Agent Workflows When developers build AI agent tools using the Model Context Protocol (MCP) or GitHub Action agent workflows (github/gh-aw), they often assume that using high-level languages (TypeScript, Python, Go) eliminates boundary safety concerns.

While classic stack/heap buffer overflows are mitigated by managed runtimes, semantic boundary violations take their place: Unchecked Workflow & File Boundary Expansion (GHSA-796w-fvw2-ccmp): In github/gh-aw, predictable non-exclusive .tmp file writes and path handling crossed expected isolation boundaries (remediated in PR #73575). Socket-Level SSRF Boundary Bypasses (GHSA-qm7x-j9xp-x3gv): In MCP servers like czlonkowski/n8n-mcp, failure to resolve and canonicalize IP addresses before initiating outbound HTTP requests allows indirect prompt injections to pivot into 127.0.0.1 and cloud metadata endpoints (169.254.169.254). 3.

Open-Source Defensive Tooling Matrix To audit and prevent these vulnerability classes systematically across CI/CD pipelines, we developed and open-sourced three MIT-licensed verification frameworks (DOI: 10.5281/zenodo.23641037, ORCID: 0009-0002-4183-0361): c-bounds-audit-framework: Deterministic static analysis engine and LibFuzzer/ASan harness templates detecting off-by-one errors and unchecked length fields in C/C++ network dissectors. protobuf-bounds-auditor: Schema-aware AST & wire-format security analyzer for .proto definitions and C/C++ deserializers. mcp-ssrf-auditor: Automated boundary and SSRF scanner for Model Context Protocol (MCP) servers, simulating 40+ IP obfuscation and redirect bypass vectors with SARIF v2.1.0 output. By applying deterministic boundary verification at both compile-time and runtime, we can harden both native network infrastructure and autonomous AI agent ecosystems before vulnerabilities reach production. Read our companion article on Auditing MCP Servers for SSRF and explore our full research portfolio at ccsimplyspolit.github.io.