Findings

Across all targets, most severe first.

Severity	Title	Target	File	Triage
low	Raw expvar values inserted into JSON response without validation ExpvarHandler	swesweep-fasthttp	expvarhandler/expvar.go	–
low	Unbounded expvar response generation ExpvarHandler	swesweep-fasthttp	expvarhandler/expvar.go	–
low	Convenience dialers default to no timeout FasthttpHTTPDialer	swesweep-fasthttp	fasthttpproxy/http.go	–
low	TLS/HTTP proxy selection based on ':443' port suffix heuristic GetDialFunc (slow-path closure)	swesweep-fasthttp	fasthttpproxy/dialer.go	–
low	Unvalidated proxy path component injected into socket address addrAndAuth	swesweep-fasthttp	fasthttpproxy/dialer.go	–
low	SetsockoptInt error can be silently discarded in the Control callback Control closure in listenConfig.Control, invoked by reuseport.Listen	swesweep-fasthttp	reuseport/reuseport_windows.go	–
low	Listen does not validate that network is a TCP network Listen	swesweep-fasthttp	reuseport/reuseport_solaris.go	–
low	Setsockopt failures are not propagated from listenConfig.Control listenConfig.Control	swesweep-fasthttp	reuseport/reuseport_solaris.go	–
low	Setsockopt errors can be silently discarded listenConfig.Control	swesweep-fasthttp	reuseport/reuseport_aix.go	–
low	Possible TCP Fast Open socket-option misuse enableFastOpen	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Unbounded read of /proc/sys/net/core/somaxconn soMaxConn	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	kernelVersion can overflow or misparse malformed uname.Release kernelVersion	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Integer overflow in maxAckBacklog on 32-bit when size is 32 maxAckBacklog	swesweep-fasthttp	tcplisten/tcplisten_linux.go	–
low	Fragile SO_REUSEPORT detection based on error-text substring match Listen	swesweep-fasthttp	reuseport/reuseport.go	–
low	Positive Backlog can be truncated in listen(2) on 64-bit platforms (*Config).fdSetup	swesweep-fasthttp	tcplisten/tcplisten.go	–
low	FcntlInt is called on an invalid fd when socket creation fails newSocketCloexec	swesweep-fasthttp	tcplisten/socket_zos_s390x.go	–
low	F_SETFD error can be masked and return a socket without FD_CLOEXEC newSocketCloexec	swesweep-fasthttp	tcplisten/socket_zos_s390x.go	–
low	Error path can retain pooled output buffer and allow unbounded growth (*writer).do	swesweep-fasthttp	stackless/writer.go	–
low	Missing validation of newWriter and returned underlying writer can cause nil interface panics NewWriter	swesweep-fasthttp	stackless/writer.go	–
low	Unchecked CloseOnExec error can leave listener fd inheritable across exec newSocketCloexecOld	swesweep-fasthttp	tcplisten/socket.go	–
low	Attacker-controlled ctx objects retained by bounded queue NewFunc	swesweep-fasthttp	stackless/func.go	–
low	No timeout, cancellation, or execution bound for f funcWorker	swesweep-fasthttp	stackless/func.go	–
low	Mutable unsafe aliasing of string data s2b	swesweep-fasthttp	fasthttputil/s2b.go	–
low	Host port validation accepts unbounded numeric port length validOptionalPort	swesweep-fasthttp	uri.go	–
low	Setters bypass URI validation used by Parse SetHostBytes/SetPathBytes/SetQueryStringBytes/SetHashBytes	swesweep-fasthttp	uri.go	–
low	Raw dot segments can be emitted when path normalization is disabled RequestURI	swesweep-fasthttp	uri.go	–
low	UpdateBytes leaves inconsistent URI state on parse failure updateBytes	swesweep-fasthttp	uri.go	–
low	Windows backslash dot-segment normalization can produce non-canonical paths normalizePath	swesweep-fasthttp	uri.go	–
low	Data race on writeDeadlineCh between Write and SetWriteDeadline Write, SetWriteDeadline	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Empty writes can produce Read returns of 0, nil Write, Read	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Queued attacker data can be read after a read deadline has expired readNextByteBuffer	swesweep-fasthttp	fasthttputil/pipeconns.go	–
low	Caller-supplied net.Addr implementations are trusted and can cause side-effect DoS SetLocalAddr	swesweep-fasthttp	fasthttputil/inmemory_listener.go	–
low	Dial creates a client connection with a nil local address Dial	swesweep-fasthttp	fasthttputil/inmemory_listener.go	–
low	Raw response body printed to stdout main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Missing explicit client timeouts and resource bounds main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Hardcoded credentials sent to local endpoint main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Ignored URI parse error main	swesweep-fasthttp	examples/host_client/hostclient.go	–
low	Reflected request fields are served without cache and MIME-sniffing hardening requestHandler	swesweep-fasthttp	examples/helloworldserver/helloworldserver.go	–
low	Empty JSON body treated as successful parse sendPostRequest	swesweep-fasthttp	examples/client/client.go	–
low	Attacker-controlled response body printed directly to output sendGetRequest	swesweep-fasthttp	examples/client/client.go	–
low	Unbounded remote response body can exhaust memory main	swesweep-fasthttp	examples/client/client.go	–
low	Unauthenticated /stats endpoint exposes expvar statistics requestHandler	swesweep-fasthttp	examples/fileserver/fileserver.go	–
low	Directory index generation enabled by default can leak file names main	swesweep-fasthttp	examples/fileserver/fileserver.go	–
low	Zstd encoder write errors are ignored on fast-path compression WriteZstdLevel	swesweep-fasthttp	zstd.go	–
low	Missing io.Writer validation can panic with nil or typed-nil writers WriteZstdLevel/WriteUnzstd	swesweep-fasthttp	zstd.go	–
low	Data race on stopCh and workerChanPool.New during concurrent lifecycle calls Start / Stop	swesweep-fasthttp	workerpool.go	–
low	Stop does not interrupt busy workers Stop	swesweep-fasthttp	workerpool.go	–
low	Stop/Start lifecycle leaves mustStop and workersCount stale Start / Stop	swesweep-fasthttp	workerpool.go	–
low	Unchecked nil WorkerFunc, connState, and Logger callbacks workerFunc	swesweep-fasthttp	workerpool.go	–
low	Unbounded user-value storage and linear lookup Set()	swesweep-fasthttp	userdata.go	–