security(codecs): cap buffered GELF payload

[pront]

Summary

Motivation

Bounding the number of incomplete messages does not bound their combined payload. Many messages can otherwise retain large chunks until completion or timeout.

Changes

• Add a hard 128 MiB ceiling for payload buffered across incomplete messages.
• Let max_length select a lower per-message ceiling without raising the aggregate limit.
• Account for stored bytes exactly across completion, rejection, errors, and timeout.
• Release only the blocked message's state when saturation prevents it from advancing.
• Update generated component documentation and add a security changelog fragment.

References

Related: #26137

Stack: #26299 -> #26300 -> #26301 -> #26302

Vector configuration

Not applicable; accounting is exercised directly at the decoder boundary.

How did you test this PR?

Focused tests exercise accounting across completion, timeout, rejection, and saturation.

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

Contributor Guidelines

• Please read our Vector contributor resources.
• Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
• Before pushing, follow our pre-push guidance.
• After a review is requested, please avoid force pushes to help us review incrementally.
  • Feel free to push as many commits as you want. They will be squashed into one before merging.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T13:50:36.286413Z	58fe63f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 496b7dc11e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[estherk15]

Left one optional suggestion, approved for docs!

[estherk15]

Suggested change

	The `chunked_gelf` framing decoder now limits the payload buffered across incomplete messages to 128 MiB. An unauthenticated sender could previously exhaust memory by sending chunks for messages it never completed, most easily on the `socket` source in UDP mode.
	The `chunked_gelf` framing decoder now limits the payload buffered across incomplete messages to 128 MiB. Previously, an unauthenticated sender could exhaust memory by sending chunks for messages it never completed, most easily on the `socket` source in UDP mode.