| medium |
ReleaseTimer panics on nil timer ReleaseTimer |
swesweep-fasthttp |
timer.go |
INVALID
|
| medium |
No concurrency limit on DNS resolution — unlimited concurrent resolver queries dial / getTCPAddrs |
swesweep-fasthttp |
tcpdialer.go |
INVALID
|
| medium |
Unbounded DNS cache growth allows memory exhaustion getTCPAddrs / dial |
swesweep-fasthttp |
tcpdialer.go |
INVALID
|
| medium |
Premature end-of-stream is reported as normal EOF for fixed Content-Length bodies requestStream.Read |
swesweep-fasthttp |
streaming.go |
INVALID
|
| medium |
Unbounded multipart form memory allocation via default FormValue/MultipartForm (DoS) RequestCtx.FormValue / RequestCtx.MultipartForm |
swesweep-fasthttp |
server.go |
INVALID
|
| medium |
Index out of range panic in FormFile on empty file header slice RequestCtx.FormFile |
swesweep-fasthttp |
server.go |
INVALID
|
| medium |
Nil StreamWriter accepted without validation NewStreamReader |
swesweep-fasthttp |
stream.go |
INVALID
|
| medium |
HTTP status-line control-character injection formatStatusLine |
swesweep-fasthttp |
status.go |
INVALID
|
| medium |
Pooled wrapper can be closed after reuse, closing a different connection perIPConn.Close / perIPTLSConn.Close |
swesweep-fasthttp |
peripconn.go |
INVALID
|
| medium |
Unvalidated IPv6 zone allows arbitrary bytes validateIPv6Literal |
swesweep-fasthttp |
ipv6.go |
INVALID
|
| medium |
Nil request or response forwarded unchecked to client and health callback lbClient.DoDeadline |
swesweep-fasthttp |
lbclient.go |
INVALID
|
| medium |
Lazy init panics when Clients is empty even if AddClient populated cs LBClient.init |
swesweep-fasthttp |
lbclient.go |
INVALID
|
| medium |
ContinueReadBodyStream silently returns oversized body stream on ErrBodyTooLarge ContinueReadBodyStream |
swesweep-fasthttp |
http.go |
INVALID
|
| medium |
readBodyIdentity allows unbounded body growth when maxBodySize <= 0 readBodyIdentity |
swesweep-fasthttp |
http.go |
INVALID
|
| medium |
Silent acceptance of duplicate Content-Length with divergent values parseHeaders (ResponseHeader) |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
Partial header state corruption after trailer parse error tryReadTrailer |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
Information disclosure: raw header bytes in error messages headerErrorMsg |
swesweep-fasthttp |
header.go |
INVALID
|
| medium |
ParseBytes can retain CRLF from raw input Cookie.ParseBytes |
swesweep-fasthttp |
cookie.go |
INVALID
|
| medium |
Cookie header injection in request cookie serializer appendRequestCookieBytes |
swesweep-fasthttp |
cookie.go |
INVALID
|
| medium |
Nil pointer dereference panics in all public Do* entry points Do, DoTimeout, DoDeadline, DoRedirects (package-level, Client, HostClient) |
swesweep-fasthttp |
client.go |
INVALID
|
| medium |
Out-of-range compression level is passed to brotli.NewWriterLevel and pooled under a normalized key acquireRealBrotliWriter |
swesweep-fasthttp |
brotli.go |
INVALID
|
| medium |
Unsafe zero-copy string aliases mutable attacker-controlled buffer b2s |
swesweep-fasthttp |
b2s.go |
INVALID
|
| medium |
Write errors silently swallowed in stackless compression path WriteBrotliLevel / nonblockingWriteBrotli |
swesweep-fasthttp |
brotli.go |
INVALID
|