From f085ed0e6d2d33affa1d168386164c5d7aba4515 Mon Sep 17 00:00:00 2001
From: Ville Vesilehto <ville@vesilehto.fi>
Date: Tue, 14 Oct 2025 17:31:57 +0300
Subject: [PATCH] fix(multisocket): cap num sockets to prevent OOM (#7615)

---
 plugin/multisocket/README.md           | 2 +-
 plugin/multisocket/multisocket.go      | 4 ++++
 plugin/multisocket/multisocket_test.go | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/plugin/multisocket/README.md b/plugin/multisocket/README.md
index 65f7986d4..6fb020249 100644
--- a/plugin/multisocket/README.md
+++ b/plugin/multisocket/README.md
@@ -19,7 +19,7 @@ large number of CPU cores.
 multisocket [NUM_SOCKETS]
 ~~~
 
-* **NUM_SOCKETS** - the number of servers that will listen on one port. Default value is equal to GOMAXPROCS.
+* **NUM_SOCKETS** - the number of servers that will listen on one port. Default value is equal to GOMAXPROCS. Maximum value is 1024.
 
 ## Examples
 
diff --git a/plugin/multisocket/multisocket.go b/plugin/multisocket/multisocket.go
index 682771682..d2c1a4107 100644
--- a/plugin/multisocket/multisocket.go
+++ b/plugin/multisocket/multisocket.go
@@ -11,6 +11,7 @@ import (
 )
 
 const pluginName = "multisocket"
+const maxNumSockets = 1024
 
 func init() { plugin.Register(pluginName, setup) }
 
@@ -45,6 +46,9 @@ func parseNumSockets(c *caddy.Controller) error {
 	if numSockets < 1 {
 		return fmt.Errorf("num sockets can not be zero or negative: %d", numSockets)
 	}
+	if numSockets > maxNumSockets {
+		return fmt.Errorf("num sockets exceeds maximum (%d): %d", maxNumSockets, numSockets)
+	}
 	config.NumSockets = numSockets
 
 	return nil
diff --git a/plugin/multisocket/multisocket_test.go b/plugin/multisocket/multisocket_test.go
index ace5ba8a2..40525ef9e 100644
--- a/plugin/multisocket/multisocket_test.go
+++ b/plugin/multisocket/multisocket_test.go
@@ -19,10 +19,12 @@ func TestMultisocket(t *testing.T) {
 		// positive
 		{`multisocket`, false, runtime.GOMAXPROCS(0), ""},
 		{`multisocket 2`, false, 2, ""},
+		{`multisocket 1024`, false, 1024, ""},
 		{` multisocket 1`, false, 1, ""},
 		{`multisocket text`, true, 0, "invalid num sockets"},
 		{`multisocket 0`, true, 0, "num sockets can not be zero or negative"},
 		{`multisocket -1`, true, 0, "num sockets can not be zero or negative"},
+		{`multisocket 1025`, true, 0, "num sockets exceeds maximum"},
 		{`multisocket 2 2`, true, 0, "Wrong argument count or unexpected line ending after '2'"},
 		{`multisocket 2 {
 			block