Findings

Across all targets, most severe first.

Severity	Title	Target	File	Triage
low	Replacing or clearing a Closer user value without closing it Set()	swesweep-fasthttp	userdata.go	–
low	Windows drive-path heuristic can bypass leading-slash normalization addLeadingSlash	swesweep-fasthttp	uri_windows.go	–
low	Invalid certificate PEM is returned when x509.CreateCertificate fails GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	Expensive RSA-2048 key generation on every call is a DoS surface GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	Unvalidated host input allows unbounded certificate material and nonconforming SANs GenerateTestCertificate	swesweep-fasthttp	tls.go	–
low	AcquireTimer does not validate timeout duration AcquireTimer	swesweep-fasthttp	timer.go	–
low	initTimer can panic if a pooled timer is still active initTimer	swesweep-fasthttp	timer.go	–
low	Unchecked interface type assertion in AcquireTimer AcquireTimer	swesweep-fasthttp	timer.go	–
low	TOCTOU race in getTCPAddrs causes redundant resolution and orphaned cache entries getTCPAddrs	swesweep-fasthttp	tcpdialer.go	–
low	Background DNS cache cleaner goroutine never terminates (goroutine leak) tcpAddrsClean	swesweep-fasthttp	tcpdialer.go	–
low	Unchecked accumulation in totalBytesRead can overflow length accounting requestStream.Read	swesweep-fasthttp	streaming.go	–
low	int64 to int truncation of prefetched buffer size requestStream.Read	swesweep-fasthttp	streaming.go	–
low	Resource leak (br/bw/ctx) on handler panic in serveConn Server.serveConn	swesweep-fasthttp	server.go	–
low	Nil handler in ServeConn causes panic on first request ServeConn (package-level)	swesweep-fasthttp	server.go	–
low	Concurrency slot leak when handler panics in TimeoutWithCodeHandler TimeoutWithCodeHandler	swesweep-fasthttp	server.go	–
low	Abandoned reader can leave stream writer blocked indefinitely NewStreamReader	swesweep-fasthttp	stream.go	–
low	Valid IPv4-embedded IPv6 addresses with '::' immediately before the IPv4 tail are rejected validateIPv6Literal	swesweep-fasthttp	ipv6.go	–
low	Exported field mutation can race with AddClient and Do LBClient.AddClient	swesweep-fasthttp	lbclient.go	–
low	RemoveClients accepts nil callback and panics without releasing lock LBClient.RemoveClients	swesweep-fasthttp	lbclient.go	–
low	Panic on negative int in writeHexInt / AppendUint (DoS if reachable) writeHexInt, AppendUint	swesweep-fasthttp	bytesconv.go	–
low	ParseUfloat checks negative value before parse error ParseUfloat	swesweep-fasthttp	bytesconv.go	–
low	Unbounded growth of global filesLockMap sync.Map getFileLock / compressAndOpenFSFile	swesweep-fasthttp	fs.go	–
low	Unbounded trailer accumulation via direct AddTrailerBytes calls AddTrailerBytes	swesweep-fasthttp	header.go	–
low	VisitHeaderParams passes unvalidated bytes through escape handling VisitHeaderParams	swesweep-fasthttp	header.go	–
low	Quote-unaware cookie scanner truncates values cookieScanner.next/nextRaw	swesweep-fasthttp	cookie.go	–
low	Parsed SameSite and Partitioned attributes bypass safety invariants Cookie.ParseBytes	swesweep-fasthttp	cookie.go	–
low	Max-Age integer wrap can alter cookie lifetime Cookie.ParseBytes	swesweep-fasthttp	cookie.go	–
low	Ignored error on fallback compression writer creation can yield nil writer acquireRealGzipWriter / acquireRealDeflateWriter	swesweep-fasthttp	compress.go	–
low	WriteGzipLevel / WriteDeflateLevel return input length instead of compressed byte count for non-blocking writers WriteGzipLevel / WriteDeflateLevel	swesweep-fasthttp	compress.go	–
low	AddMissingPort fails to append default port for unbracketed IPv6 literals AddMissingPort	swesweep-fasthttp	client.go	–
low	Possible index-out-of-range panic in b2s for empty byte slices AddBytesKV / SetBytesKV / DelBytes / PeekMultiBytes (via b2s)	swesweep-fasthttp	args.go	–
low	Algorithmic-complexity DoS in Args.Del/DelBytes (O(n^2) delAllArgsStable) delAllArgsStable / Del / DelBytes	swesweep-fasthttp	args.go	–
low	WriteBrotliLevel returns uncompressed input length instead of compressed byte count for non-blocking writers WriteBrotliLevel	swesweep-fasthttp	brotli.go	–
low	Quadratic copy cost when deleting many duplicate query args Args.Del	swesweep-fasthttp	args.go	–
low	Stale key/value slices retained after Reset, ReleaseArgs, and Del Args.Reset	swesweep-fasthttp	args.go	–
low	Nil io.Writer causes panic in WriteBrotliLevel default branch WriteBrotliLevel	swesweep-fasthttp	brotli.go	–
info	parseIPv4Octet 'parsed' field can overflow on 32-bit with long leading-zero input parseIPv4Octet	swesweep-fasthttp	bytesconv.go	–