security(codecs): bound chunked GELF memory

[pront]

Summary

Superseded by the smaller review stack #26299 -> #26300 -> #26301 -> #26302.

Motivation

The chunked_gelf decoder retains incomplete messages until they complete or time out. Neither the pending-message count nor aggregate buffered payload had an unconditional bound, so an unauthenticated sender could exhaust memory using unique message IDs it never completes.

The replacement stack separates the assembly cleanup, single-chunk correctness, pending-message count ceiling, and aggregate payload ceiling so each invariant can be reviewed independently.

Changes

• refactor(codecs): assemble final GELF chunk directly #26299 refactors final-chunk assembly.
• fix(codecs): handle single-chunk GELF messages directly #26300 handles single-chunk messages directly.
• security(codecs): cap pending GELF messages #26301 caps the number of pending messages.
• security(codecs): cap buffered GELF payload #26302 caps aggregate buffered payload.

References

Replaced by: #26299, #26300, #26301, #26302

Vector configuration

sources:
  graylog:
    type: socket
    mode: udp
    address: 0.0.0.0:12201
    framing:
      method: chunked_gelf
    decoding:
      codec: gelf

sinks:
  out:
    type: blackhole
    inputs:
      - graylog

How did you test this PR?

Focused chunked GELF tests cover assembly, buffer ownership, both limits, and accounting across completion, timeout, rejection, and saturation.

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

Contributor Guidelines

The repository contributor and pre-push guidance was followed.

[pront]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T16:21:16.853321Z	2bd9eb2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f43b72ce22

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5bbcf19ca9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2bd9eb2a69

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[pront]

Superseded by the smaller stacked PRs #26299, #26300, #26301, and #26302. The open review finding was fixed in #26299 and carried through the stack.