| medium |
Flush() can block forever after completion or hijack writer.Flush |
swesweep-fasthttp |
fasthttpadaptor/adaptor.go |
INVALID
|
| medium |
Wrapped handler panic is re-panicked in the fasthttp handler goroutine NewFastHTTPHandler |
swesweep-fasthttp |
fasthttpadaptor/adaptor.go |
INVALID
|
| medium |
Unbounded pre-Flush response buffering allows memory exhaustion writer.Write |
swesweep-fasthttp |
fasthttpadaptor/adaptor.go |
INVALID
|
| medium |
Stale child signals and PID reuse can corrupt child process tracking Prefork.prefork |
swesweep-fasthttp |
prefork/prefork.go |
INVALID
|
| medium |
Special header cases are matched before canonicalization and are case-sensitive ConvertRequest |
swesweep-fasthttp |
fasthttpadaptor/request.go |
INVALID
|
| medium |
Duplicate HTTP headers are collapsed instead of preserved ConvertRequest |
swesweep-fasthttp |
fasthttpadaptor/request.go |
VALID
|
| medium |
Stale TransferEncoding and RequestURI state when http.Request is reused ConvertRequest |
swesweep-fasthttp |
fasthttpadaptor/request.go |
INVALID
|
| medium |
Zero-copy byte-to-string conversion aliases mutable fasthttp request buffers b2s |
swesweep-fasthttp |
fasthttpadaptor/b2s.go |
INVALID
|
| medium |
Unauthenticated exposure of all registered expvars ExpvarHandler |
swesweep-fasthttp |
expvarhandler/expvar.go |
INVALID
|
| medium |
Uncontrolled regular expression compilation from r query argument getExpvarRegexp |
swesweep-fasthttp |
expvarhandler/expvar.go |
VALID
|
| medium |
Nil fasthttp.DialFunc returned on malformed proxy environment, causing process panic FasthttpProxyHTTPDialerTimeout |
swesweep-fasthttp |
fasthttpproxy/proxy_env.go |
INVALID
|
| medium |
Unbounded hang on CONNECT when ConnectTimeout is zero (default) httpProxyDial |
swesweep-fasthttp |
fasthttpproxy/dialer.go |
INVALID
|
| medium |
Protocol desync: bufio.Reader discards tunneled data after CONNECT 200 httpProxyDial |
swesweep-fasthttp |
fasthttpproxy/dialer.go |
INVALID
|
| medium |
Nil Config receiver can panic in NewListener (*Config).NewListener |
swesweep-fasthttp |
tcplisten/tcplisten.go |
INVALID
|
| medium |
File descriptor leak when fcntl fails after socket creation newSocketCloexec |
swesweep-fasthttp |
tcplisten/socket_zos_s390x.go |
INVALID
|
| medium |
Nil destination writer causes panic when flushing buffered output (*writer).do |
swesweep-fasthttp |
stackless/writer.go |
INVALID
|
| medium |
Hidden worker can be terminated by f panic or runtime.Goexit funcWorker |
swesweep-fasthttp |
stackless/func.go |
INVALID
|
| medium |
Permanent worker goroutines and channel per NewFunc instance NewFunc |
swesweep-fasthttp |
stackless/func.go |
INVALID
|
| medium |
Goroutine and memory leak on client disconnect during long profile or trace PprofHandler |
swesweep-fasthttp |
pprofhandler/pprof.go |
INVALID
|
| medium |
Quadratic-time denial of service in path normalization normalizePath |
swesweep-fasthttp |
uri.go |
VALID
|
| medium |
Write timeout discards pooled buffer and latches write deadline to closed Write |
swesweep-fasthttp |
fasthttputil/pipeconns.go |
INVALID
|
| medium |
Unbounded writer blocking when the receiving end fills the channel and stops reading Write |
swesweep-fasthttp |
fasthttputil/pipeconns.go |
INVALID
|
| medium |
Default fasthttp server is used without timeouts, body-size, or concurrency limits main |
swesweep-fasthttp |
examples/helloworldserver/helloworldserver.go |
INVALID
|
| medium |
Host-header-controlled path rewrite when -vhost is enabled main |
swesweep-fasthttp |
examples/fileserver/fileserver.go |
INVALID
|
| medium |
Reset may invoke malicious or invalid io.Closer values Reset() |
swesweep-fasthttp |
userdata.go |
INVALID
|
| medium |
ReleaseTimer panics on nil timer ReleaseTimer |
swesweep-fasthttp |
timer.go |
INVALID
|
| medium |
No concurrency limit on DNS resolution — unlimited concurrent resolver queries dial / getTCPAddrs |
swesweep-fasthttp |
tcpdialer.go |
INVALID
|
| medium |
Unbounded DNS cache growth allows memory exhaustion getTCPAddrs / dial |
swesweep-fasthttp |
tcpdialer.go |
INVALID
|
| medium |
Premature end-of-stream is reported as normal EOF for fixed Content-Length bodies requestStream.Read |
swesweep-fasthttp |
streaming.go |
INVALID
|
| medium |
LF-only header line separation creates parser differential readLine |
swesweep-fasthttp |
headerscanner.go |
VALID
|
| medium |
Unbounded multipart form memory allocation via default FormValue/MultipartForm (DoS) RequestCtx.FormValue / RequestCtx.MultipartForm |
swesweep-fasthttp |
server.go |
INVALID
|
| medium |
Index out of range panic in FormFile on empty file header slice RequestCtx.FormFile |
swesweep-fasthttp |
server.go |
INVALID
|
| medium |
Nil StreamWriter accepted without validation NewStreamReader |
swesweep-fasthttp |
stream.go |
INVALID
|
| medium |
HTTP status-line control-character injection formatStatusLine |
swesweep-fasthttp |
status.go |
INVALID
|
| medium |
Pooled wrapper can be closed after reuse, closing a different connection perIPConn.Close / perIPTLSConn.Close |
swesweep-fasthttp |
peripconn.go |
INVALID
|
| medium |
IPv6 and non-TCP remote addresses collapse to the same counter key 0 getConnIP4 |
swesweep-fasthttp |
peripconn.go |
VALID
|
| medium |
Unvalidated IPv6 zone allows arbitrary bytes validateIPv6Literal |
swesweep-fasthttp |
ipv6.go |
INVALID
|
| medium |
Nil request or response forwarded unchecked to client and health callback lbClient.DoDeadline |
swesweep-fasthttp |
lbclient.go |
INVALID
|
| medium |
Lazy init panics when Clients is empty even if AddClient populated cs LBClient.init |
swesweep-fasthttp |
lbclient.go |
INVALID
|
| medium |
ContinueReadBodyStream silently returns oversized body stream on ErrBodyTooLarge ContinueReadBodyStream |
swesweep-fasthttp |
http.go |
INVALID
|
| medium |
readBodyIdentity allows unbounded body growth when maxBodySize <= 0 readBodyIdentity |
swesweep-fasthttp |
http.go |
INVALID
|
| medium |
Silent acceptance of duplicate Content-Length with divergent values parseHeaders (ResponseHeader) |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
Partial header state corruption after trailer parse error tryReadTrailer |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
Information disclosure: raw header bytes in error messages headerErrorMsg |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
ParseBytes can retain CRLF from raw input Cookie.ParseBytes |
swesweep-fasthttp |
cookie.go |
INVALID
|
| medium |
Cookie header injection in request cookie serializer appendRequestCookieBytes |
swesweep-fasthttp |
cookie.go |
INVALID
|
| medium |
Decompression bomb: no output size limit in public decompression API WriteGunzip / WriteInflate / AppendGunzipBytes / AppendInflateBytes |
swesweep-fasthttp |
compress.go |
VALID
|
| medium |
Nil pointer dereference panics in all public Do* entry points Do, DoTimeout, DoDeadline, DoRedirects (package-level, Client, HostClient) |
swesweep-fasthttp |
client.go |
INVALID
|
| medium |
Out-of-range compression level is passed to brotli.NewWriterLevel and pooled under a normalized key acquireRealBrotliWriter |
swesweep-fasthttp |
brotli.go |
INVALID
|
| medium |
Unsafe zero-copy string aliases mutable attacker-controlled buffer b2s |
swesweep-fasthttp |
b2s.go |
INVALID
|