WAD Process Memory Leak in HTTP POST Request Body Buffering over Explicit Proxy
FortiOS Explicit Web Proxy daemon /bin/wad leaks slab buffer pages during client-aborted HTTP POST file uploads, steadily exhausting system RAM until the firewall enters Conserve Mode and drops active user connections.
Technical Root Cause Analysis
When web clients submit large HTTP POST payloads (such as cloud drive backups, SaaS attachment uploads, or form submissions) through FortiOS Explicit Web Proxy, the WAD proxy worker dynamically allocates memory slabs via wad_http_post_buffer to hold request body content for Data Loss Prevention (DLP) and Antivirus inspection.
In FortiOS 7.2.3 through 7.2.6, if a client endpoint aborts an upload in progress—dispatching a TCP FIN or RST packet before the server completes its HTTP response—the WAD session teardown state machine encounters an unhandled exception branch.
The socket is destroyed, but the pointer to the linked slab buffer chain is lost without invoking the deallocation routine http_buffer_free. Over hours of normal enterprise traffic, orphaned slab pages accumulate into gigabytes of unrecoverable RAM, driving the appliance past the 88% red threshold into Conserve Mode.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.3 – 7.2.6 | 7.2.7+ | Cap max-request-length & recycle workers |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Buffer teardown routine patched |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy buffering pipeline frees buffers at socket close |
Platform Impact: Affects all FortiGate models operating Explicit Web Proxy, Transparent Proxy, or ZTNA HTTPS Access Proxy with proxy-mode inspection enabled.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to verify whether WAD workers are leaking heap RAM and inspect current system conserve mode status:
Diagnostic Commands
# 1. Audit per-worker memory consumption across all WAD processes
diagnose test application wad 1000
# 2. Query top 10 memory-consuming processes
diagnose sys top-mem 10
# 3. Check current conserve mode status and system memory distribution
diagnose hardware sysinfo conserve
# 4. Check explicit proxy session buffer counters
diagnose test application wad 2200Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Aborted client HTTP POST file uploads fail to trigger buffer cleanup routines when a TCP FIN is received, permanently stranding allocated slab pages in worker user-space RAM.
Setting set max-request-length 32 under config web-proxy global caps buffer sizing, and periodically recycling bloated workers with diagnose sys kill 15 <pid> releases orphaned RAM.
FortiOS 7.2.7, 7.4.2, and all subsequent versions correctly release slab buffer structures upon receiving client TCP resets or FIN packets.