BudgetScan

Findings

Across all targets, most severe first.

Clear
SeverityTitleTargetFileTriage
critical Content-Length stream can consume bytes beyond the declared body length requestStream.Read swesweep-fasthttp streaming.go
VALID
critical appendBodyFixedSize lacks negative-size guard, panics on negative n appendBodyFixedSize swesweep-fasthttp http.go
INVALID
critical Integer overflow in chunked Transfer-Encoding chunk size causes panic (remote DoS) readBodyChunked swesweep-fasthttp http.go
VALID
high Pooled response buffer reused before fasthttp finishes writing response NewFastHTTPHandler swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
high Aliased fasthttp buffers can become stale or corrupted in the returned http.Request ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc in dual-stack variant FasthttpSocksDialerDualStack swesweep-fasthttp fasthttpproxy/socks5.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc FasthttpSocksDialer swesweep-fasthttp fasthttpproxy/socks5.go
INVALID
high Nil DialFunc returned when proxy setup fails (dual-stack) FasthttpHTTPDialerDualStackTimeout swesweep-fasthttp fasthttpproxy/http.go
INVALID
high Nil DialFunc returned when proxy setup fails FasthttpHTTPDialerTimeout swesweep-fasthttp fasthttpproxy/http.go
VALID
high Reset silently changes destination writer when stackless reset cannot execute (*writer).Reset swesweep-fasthttp stackless/writer.go
INVALID
high Unbounded DoS via attacker-controlled 'seconds' parameter on profile and trace endpoints PprofHandler swesweep-fasthttp pprofhandler/pprof.go
VALID
high Pending dial holds listener mutex and can deadlock Close DialWithLocalAddr swesweep-fasthttp fasthttputil/inmemory_listener.go
INVALID
high Unbounded reflection of attacker-controlled request data enables denial of service requestHandler swesweep-fasthttp examples/helloworldserver/helloworldserver.go
INVALID
high Unbounded zstd decompression enables remote DoS via decompression bomb WriteUnzstd swesweep-fasthttp zstd.go
INVALID
high Unrecovered panic in worker goroutine can crash host or corrupt pool accounting workerFunc / getCh goroutine swesweep-fasthttp workerpool.go
INVALID
high Panic from comparing uncomparable any keys Set()/Get()/Remove() swesweep-fasthttp userdata.go
INVALID
high Chunk size result is not validated before being used as a slice bound requestStream.Read swesweep-fasthttp streaming.go
INVALID
high EOF detection in prefetched Content-Length read uses per-call n instead of totalBytesRead requestStream.Read swesweep-fasthttp streaming.go
INVALID
high acquireRequestStream does not clamp prefetched bytes to ContentLength acquireRequestStream swesweep-fasthttp streaming.go
INVALID
high Out-of-bounds read in skipSpace at buffer end skipSpace swesweep-fasthttp headerscanner.go
INVALID
high Infinite loop in readLine when no newline remains readLine swesweep-fasthttp headerscanner.go
VALID
high Stream writer goroutine lacks panic recovery and cleanup NewStreamReader swesweep-fasthttp stream.go
INVALID
high Unbounded per-IP counter map growth from retained zero-count entries perIPConnCounter.Unregister swesweep-fasthttp peripconn.go
VALID
high IPv6 host validation bypass via bytes after first closing bracket validateIPv6Literal swesweep-fasthttp ipv6.go
INVALID
high RemoveClients callback invoked while holding write lock can deadlock or lock permanently LBClient.RemoveClients swesweep-fasthttp lbclient.go
INVALID
high Nil BalancingClient causes nil pointer dereference lbClient.DoDeadline swesweep-fasthttp lbclient.go
INVALID
high Empty client list causes slice index out-of-range panic LBClient.get swesweep-fasthttp lbclient.go
INVALID
high Unbounded gzip decompression in MultipartFormWithLimit(0) streaming path MultipartFormWithLimit swesweep-fasthttp http.go
VALID
high Decompression bomb via default no-limit BodyGunzip/BodyInflate/BodyUnbrotli/BodyUnzstd/BodyUncompressed BodyGunzip swesweep-fasthttp http.go
VALID
high Goroutine and memory leak in serveFS: every ServeFS/ServeFSLiteral call spawns a non-terminating cleanup goroutine serveFS / ServeFS / ServeFSLiteral swesweep-fasthttp fs.go
INVALID
high Missing delimiter and newline sanitization in cookie setters Cookie.SetKey/SetValue/SetDomain/SetPath swesweep-fasthttp cookie.go
INVALID
high Set-Cookie injection in response cookie serializer appendResponseCookieBytes swesweep-fasthttp cookie.go
INVALID
high Cookie attribute/header injection via unsanitized fields in AppendBytes Cookie.AppendBytes swesweep-fasthttp cookie.go
INVALID
high Data race on caller-supplied dst buffer after request timeout clientGetURLDeadline swesweep-fasthttp client.go
VALID
high Ignored stackless deferred-execution return value can cause a data race in brotli compression stacklessWriteBrotli swesweep-fasthttp brotli.go
INVALID
high Unbounded brotli decompression can exhaust memory WriteUnbrotli swesweep-fasthttp brotli.go
VALID
high Unbounded decompression (decompression bomb) in WriteUnbrotli / AppendUnbrotliBytes WriteUnbrotli / AppendUnbrotliBytes swesweep-fasthttp brotli.go
VALID
high Out-of-range compression level forwarded to brotli.NewWriterLevel acquireRealBrotliWriter / acquireStacklessBrotliWriter swesweep-fasthttp brotli.go
INVALID
high Unsafe string conversion aliases mutable attacker-controlled bytes b2s swesweep-fasthttp b2s.go
INVALID
medium Flush() can block forever after completion or hijack writer.Flush swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Wrapped handler panic is re-panicked in the fasthttp handler goroutine NewFastHTTPHandler swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Unbounded pre-Flush response buffering allows memory exhaustion writer.Write swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Stale child signals and PID reuse can corrupt child process tracking Prefork.prefork swesweep-fasthttp prefork/prefork.go
INVALID
medium Special header cases are matched before canonicalization and are case-sensitive ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
medium Duplicate HTTP headers are collapsed instead of preserved ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
VALID
medium Stale TransferEncoding and RequestURI state when http.Request is reused ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
medium Zero-copy byte-to-string conversion aliases mutable fasthttp request buffers b2s swesweep-fasthttp fasthttpadaptor/b2s.go
INVALID
medium Unauthenticated exposure of all registered expvars ExpvarHandler swesweep-fasthttp expvarhandler/expvar.go
INVALID
medium Uncontrolled regular expression compilation from r query argument getExpvarRegexp swesweep-fasthttp expvarhandler/expvar.go
VALID
medium Nil fasthttp.DialFunc returned on malformed proxy environment, causing process panic FasthttpProxyHTTPDialerTimeout swesweep-fasthttp fasthttpproxy/proxy_env.go
INVALID
Page 1 of 4 · 187 total Next →