SebTardif opened a new pull request, #4217:
URL: https://github.com/apache/logging-log4j2/pull/4217
## What Problem This Solves
When a default `Route` embeds an appender definition, the Routing Appender
creates one subordinate appender per distinct routing key. If the key comes
from untrusted or high-cardinality data (for example `${ctx:userId}`), that can
exhaust file descriptors and memory.
## Evidence
Issue #4181 describes FD exhaustion with a user-controlled routing key and
file-backed routes. This PR documents the risk and mitigations
(`IdlePurgePolicy`, low-cardinality keys, prefer appender references).
## Summary
Adds a **Security considerations** section to the Routing Appender manual
page, linked from the existing purge-policy discussion.
Fixes #4181
### Validation
Documentation-only change under
`src/site/antora/.../appenders/delegating.adoc` plus changelog entry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
