Findings

Across all targets, most severe first.

Severity	Title	Target	File	Triage
low	Late ResponseWriter writes can race with released pooled buffers writer.Write	swesweep-fasthttp	fasthttpadaptor/adaptor.go	–
low	Hijack path does not release buffered writer resources writer.Hijack	swesweep-fasthttp	fasthttpadaptor/adaptor.go	–
low	Hijack after Flush can interleave writes on the same connection writer.Hijack	swesweep-fasthttp	fasthttpadaptor/adaptor.go	–
low	RecoverThreshold can allow unbounded child respawn under child-crash conditions Prefork.prefork	swesweep-fasthttp	prefork/prefork.go	–
low	File descriptor and listener leaks in prefork setup Prefork.setTCPListenerFiles	swesweep-fasthttp	prefork/prefork.go	–
low	Child listener blindly trusts file descriptor 3 Prefork.listen	swesweep-fasthttp	prefork/prefork.go	–
low	FASTHTTP_PREFORK_CHILD environment variable can force child-mode behavior IsChild	swesweep-fasthttp	prefork/prefork.go	–
low	New(nil) panics due to unchecked fasthttp.Server pointer New	swesweep-fasthttp	prefork/prefork.go	–
low	Nil serve callback causes child process panic Prefork.ListenAndServe	swesweep-fasthttp	prefork/prefork.go	–
low	Raw expvar values inserted into JSON response without validation ExpvarHandler	swesweep-fasthttp	expvarhandler/expvar.go	–
low	Unbounded expvar response generation ExpvarHandler	swesweep-fasthttp	expvarhandler/expvar.go	–
low	Convenience dialers default to no timeout FasthttpHTTPDialer	swesweep-fasthttp	fasthttpproxy/http.go	–
low	TLS/HTTP proxy selection based on ':443' port suffix heuristic GetDialFunc (slow-path closure)	swesweep-fasthttp	fasthttpproxy/dialer.go	–
low	Unvalidated proxy path component injected into socket address addrAndAuth	swesweep-fasthttp	fasthttpproxy/dialer.go	–
low	SetsockoptInt error can be silently discarded in the Control callback Control closure in listenConfig.Control, invoked by reuseport.Listen	swesweep-fasthttp	reuseport/reuseport_windows.go	–
low	Listen does not validate that network is a TCP network Listen	swesweep-fasthttp	reuseport/reuseport_solaris.go	–
low	Setsockopt failures are not propagated from listenConfig.Control listenConfig.Control	swesweep-fasthttp	reuseport/reuseport_solaris.go	–
low	Setsockopt errors can be silently discarded listenConfig.Control	swesweep-fasthttp	reuseport/reuseport_aix.go	–
low	Possible TCP Fast Open socket-option misuse enableFastOpen	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Unbounded read of /proc/sys/net/core/somaxconn soMaxConn	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	kernelVersion can overflow or misparse malformed uname.Release kernelVersion	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Integer overflow in maxAckBacklog on 32-bit when size is 32 maxAckBacklog	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Fragile SO_REUSEPORT detection based on error-text substring match Listen	swesweep-fasthttp	reuseport/reuseport.go	–
low	Positive Backlog can be truncated in listen(2) on 64-bit platforms (*Config).fdSetup	swesweep-fasthttp	tcplisten/tcplisten.go	–
low	FcntlInt is called on an invalid fd when socket creation fails newSocketCloexec	swesweep-fasthttp	tcplisten/socket_zos_s390x.go	–
low	F_SETFD error can be masked and return a socket without FD_CLOEXEC newSocketCloexec	swesweep-fasthttp	tcplisten/socket_zos_s390x.go	–
low	Error path can retain pooled output buffer and allow unbounded growth (*writer).do	swesweep-fasthttp	stackless/writer.go	–
low	Missing validation of newWriter and returned underlying writer can cause nil interface panics NewWriter	swesweep-fasthttp	stackless/writer.go	–
low	Unchecked CloseOnExec error can leave listener fd inheritable across exec newSocketCloexecOld	swesweep-fasthttp	tcplisten/socket.go	–
low	Attacker-controlled ctx objects retained by bounded queue NewFunc	swesweep-fasthttp	stackless/func.go	–
low	No timeout, cancellation, or execution bound for f funcWorker	swesweep-fasthttp	stackless/func.go	–
low	Mutable unsafe aliasing of string data s2b	swesweep-fasthttp	fasthttputil/s2b.go	–
low	Host port validation accepts unbounded numeric port length validOptionalPort	swesweep-fasthttp	uri.go	–
low	Setters bypass URI validation used by Parse SetHostBytes/SetPathBytes/SetQueryStringBytes/SetHashBytes	swesweep-fasthttp	uri.go	–
low	Raw dot segments can be emitted when path normalization is disabled RequestURI	swesweep-fasthttp	uri.go	–
low	UpdateBytes leaves inconsistent URI state on parse failure updateBytes	swesweep-fasthttp	uri.go	–
low	Windows backslash dot-segment normalization can produce non-canonical paths normalizePath	swesweep-fasthttp	uri.go	–
low	Data race on writeDeadlineCh between Write and SetWriteDeadline Write, SetWriteDeadline	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Empty writes can produce Read returns of 0, nil Write, Read	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Queued attacker data can be read after a read deadline has expired readNextByteBuffer	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Caller-supplied net.Addr implementations are trusted and can cause side-effect DoS SetLocalAddr	swesweep-fasthttp	fasthttputil/inmemory_listener.go	–
low	Dial creates a client connection with a nil local address Dial	swesweep-fasthttp	fasthttputil/inmemory_listener.go	–
low	Raw response body printed to stdout main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Missing explicit client timeouts and resource bounds main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Hardcoded credentials sent to local endpoint main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Ignored URI parse error main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Reflected request fields are served without cache and MIME-sniffing hardening requestHandler	swesweep-fasthttp	examples/helloworldserver/helloworldserver.go	–
low	Empty JSON body treated as successful parse sendPostRequest	swesweep-fasthttp	examples/client/client.go	–
low	Attacker-controlled response body printed directly to output sendGetRequest	swesweep-fasthttp	examples/client/client.go	–
low	Unbounded remote response body can exhaust memory main	swesweep-fasthttp	examples/client/client.go	–