BudgetScan

Findings

Across all targets, most severe first.

Clear
SeverityTitleTargetFileTriage
critical appendBodyFixedSize lacks negative-size guard, panics on negative n appendBodyFixedSize swesweep-fasthttp http.go
INVALID
high Pooled response buffer reused before fasthttp finishes writing response NewFastHTTPHandler swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
high Aliased fasthttp buffers can become stale or corrupted in the returned http.Request ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc in dual-stack variant FasthttpSocksDialerDualStack swesweep-fasthttp fasthttpproxy/socks5.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc FasthttpSocksDialer swesweep-fasthttp fasthttpproxy/socks5.go
INVALID
high Nil DialFunc returned when proxy setup fails (dual-stack) FasthttpHTTPDialerDualStackTimeout swesweep-fasthttp fasthttpproxy/http.go
INVALID
high Reset silently changes destination writer when stackless reset cannot execute (*writer).Reset swesweep-fasthttp stackless/writer.go
INVALID
high Pending dial holds listener mutex and can deadlock Close DialWithLocalAddr swesweep-fasthttp fasthttputil/inmemory_listener.go
INVALID
high Unbounded reflection of attacker-controlled request data enables denial of service requestHandler swesweep-fasthttp examples/helloworldserver/helloworldserver.go
INVALID
high Unbounded zstd decompression enables remote DoS via decompression bomb WriteUnzstd swesweep-fasthttp zstd.go
INVALID
high Unrecovered panic in worker goroutine can crash host or corrupt pool accounting workerFunc / getCh goroutine swesweep-fasthttp workerpool.go
INVALID
high Panic from comparing uncomparable any keys Set()/Get()/Remove() swesweep-fasthttp userdata.go
INVALID
high Chunk size result is not validated before being used as a slice bound requestStream.Read swesweep-fasthttp streaming.go
INVALID
high EOF detection in prefetched Content-Length read uses per-call n instead of totalBytesRead requestStream.Read swesweep-fasthttp streaming.go
INVALID
high acquireRequestStream does not clamp prefetched bytes to ContentLength acquireRequestStream swesweep-fasthttp streaming.go
INVALID
high Out-of-bounds read in skipSpace at buffer end skipSpace swesweep-fasthttp headerscanner.go
INVALID
high Stream writer goroutine lacks panic recovery and cleanup NewStreamReader swesweep-fasthttp stream.go
INVALID
high IPv6 host validation bypass via bytes after first closing bracket validateIPv6Literal swesweep-fasthttp ipv6.go
INVALID
high RemoveClients callback invoked while holding write lock can deadlock or lock permanently LBClient.RemoveClients swesweep-fasthttp lbclient.go
INVALID
high Nil BalancingClient causes nil pointer dereference lbClient.DoDeadline swesweep-fasthttp lbclient.go
INVALID
high Empty client list causes slice index out-of-range panic LBClient.get swesweep-fasthttp lbclient.go
INVALID
high Goroutine and memory leak in serveFS: every ServeFS/ServeFSLiteral call spawns a non-terminating cleanup goroutine serveFS / ServeFS / ServeFSLiteral swesweep-fasthttp fs.go
INVALID
high Missing delimiter and newline sanitization in cookie setters Cookie.SetKey/SetValue/SetDomain/SetPath swesweep-fasthttp cookie.go
INVALID
high Set-Cookie injection in response cookie serializer appendResponseCookieBytes swesweep-fasthttp cookie.go
INVALID
high Cookie attribute/header injection via unsanitized fields in AppendBytes Cookie.AppendBytes swesweep-fasthttp cookie.go
INVALID
high Ignored stackless deferred-execution return value can cause a data race in brotli compression stacklessWriteBrotli swesweep-fasthttp brotli.go
INVALID
high Out-of-range compression level forwarded to brotli.NewWriterLevel acquireRealBrotliWriter / acquireStacklessBrotliWriter swesweep-fasthttp brotli.go
INVALID
high Unsafe string conversion aliases mutable attacker-controlled bytes b2s swesweep-fasthttp b2s.go
INVALID
medium Flush() can block forever after completion or hijack writer.Flush swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Wrapped handler panic is re-panicked in the fasthttp handler goroutine NewFastHTTPHandler swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Unbounded pre-Flush response buffering allows memory exhaustion writer.Write swesweep-fasthttp fasthttpadaptor/adaptor.go
INVALID
medium Stale child signals and PID reuse can corrupt child process tracking Prefork.prefork swesweep-fasthttp prefork/prefork.go
INVALID
medium Special header cases are matched before canonicalization and are case-sensitive ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
medium Stale TransferEncoding and RequestURI state when http.Request is reused ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
INVALID
medium Zero-copy byte-to-string conversion aliases mutable fasthttp request buffers b2s swesweep-fasthttp fasthttpadaptor/b2s.go
INVALID
medium Unauthenticated exposure of all registered expvars ExpvarHandler swesweep-fasthttp expvarhandler/expvar.go
INVALID
medium Nil fasthttp.DialFunc returned on malformed proxy environment, causing process panic FasthttpProxyHTTPDialerTimeout swesweep-fasthttp fasthttpproxy/proxy_env.go
INVALID
medium Unbounded hang on CONNECT when ConnectTimeout is zero (default) httpProxyDial swesweep-fasthttp fasthttpproxy/dialer.go
INVALID
medium Protocol desync: bufio.Reader discards tunneled data after CONNECT 200 httpProxyDial swesweep-fasthttp fasthttpproxy/dialer.go
INVALID
medium Nil Config receiver can panic in NewListener (*Config).NewListener swesweep-fasthttp tcplisten/tcplisten.go
INVALID
medium File descriptor leak when fcntl fails after socket creation newSocketCloexec swesweep-fasthttp tcplisten/socket_zos_s390x.go
INVALID
medium Nil destination writer causes panic when flushing buffered output (*writer).do swesweep-fasthttp stackless/writer.go
INVALID
medium Hidden worker can be terminated by f panic or runtime.Goexit funcWorker swesweep-fasthttp stackless/func.go
INVALID
medium Permanent worker goroutines and channel per NewFunc instance NewFunc swesweep-fasthttp stackless/func.go
INVALID
medium Goroutine and memory leak on client disconnect during long profile or trace PprofHandler swesweep-fasthttp pprofhandler/pprof.go
INVALID
medium Write timeout discards pooled buffer and latches write deadline to closed Write swesweep-fasthttp fasthttputil/pipeconns.go
INVALID
medium Unbounded writer blocking when the receiving end fills the channel and stops reading Write swesweep-fasthttp fasthttputil/pipeconns.go
INVALID
medium Default fasthttp server is used without timeouts, body-size, or concurrency limits main swesweep-fasthttp examples/helloworldserver/helloworldserver.go
INVALID
medium Host-header-controlled path rewrite when -vhost is enabled main swesweep-fasthttp examples/fileserver/fileserver.go
INVALID
medium Reset may invoke malicious or invalid io.Closer values Reset() swesweep-fasthttp userdata.go
INVALID
Page 1 of 2 · 73 total Next →