| critical |
Content-Length stream can consume bytes beyond the declared body length |
swesweep-fasthttp |
streaming.go |
| critical |
Integer overflow in chunked Transfer-Encoding chunk size causes panic (remote DoS) |
swesweep-fasthttp |
http.go |
| high |
Nil DialFunc returned when proxy setup fails |
swesweep-fasthttp |
fasthttpproxy/http.go |
| high |
Unbounded DoS via attacker-controlled 'seconds' parameter on profile and trace endpoints |
swesweep-fasthttp |
pprofhandler/pprof.go |
| high |
Infinite loop in readLine when no newline remains |
swesweep-fasthttp |
headerscanner.go |
| high |
Unbounded per-IP counter map growth from retained zero-count entries |
swesweep-fasthttp |
peripconn.go |
| high |
Unbounded gzip decompression in MultipartFormWithLimit(0) streaming path |
swesweep-fasthttp |
http.go |
| high |
Decompression bomb via default no-limit BodyGunzip/BodyInflate/BodyUnbrotli/BodyUnzstd/BodyUncompressed |
swesweep-fasthttp |
http.go |
| high |
Data race on caller-supplied dst buffer after request timeout |
swesweep-fasthttp |
client.go |
| high |
Unbounded brotli decompression can exhaust memory |
swesweep-fasthttp |
brotli.go |
| high |
Unbounded decompression (decompression bomb) in WriteUnbrotli / AppendUnbrotliBytes |
swesweep-fasthttp |
brotli.go |
| medium |
Duplicate HTTP headers are collapsed instead of preserved |
swesweep-fasthttp |
fasthttpadaptor/request.go |
| medium |
Uncontrolled regular expression compilation from r query argument |
swesweep-fasthttp |
expvarhandler/expvar.go |
| medium |
Quadratic-time denial of service in path normalization |
swesweep-fasthttp |
uri.go |
| medium |
LF-only header line separation creates parser differential |
swesweep-fasthttp |
headerscanner.go |