BudgetScan

Run #4

swesweep-fasthttp · completed

Model
qwen/qwen3.8-27b
Triage model
qwen/qwen3.8-27b
Provider
koscompute
Started
2026-10-17 19:50:32 UTC
Completed
2026-10-18 00:48:07 UTC
Files
78 / 78
  scanned
78
  triage: completed
86
Findings
179
Tokens in / out
4,874,278 / 1,901,214
Cost
$7.75 (estimate:openrouter-list)
Throughput
85.7 tok/s

LLM calls

StageOutcomeCallsTokens inTokens outAvg service sBackoff s
arbiterok52 427,78113,602 6.970.0
contextok78 247,049609,369 145.100.0
scanempty2 14,77624,492 213.5128.3
scanok78 370,599999,097 250.47130.8
scantimeout29 00 600.14220.4
triageok430 3,814,073254,654 13.6973.6
triagetimeout24 00 600.116.2

Findings

SeverityTitleFileTriage
critical Integer overflow in chunked Transfer-Encoding chunk size causes panic (remote DoS) readBodyChunked http.go
VALID
critical appendBodyFixedSize lacks negative-size guard, panics on negative n appendBodyFixedSize http.go
INVALID
critical Content-Length stream can consume bytes beyond the declared body length requestStream.Read streaming.go
VALID
high Unbounded brotli decompression can exhaust memory WriteUnbrotli brotli.go
VALID
high Ignored stackless deferred-execution return value can cause a data race in brotli compression stacklessWriteBrotli brotli.go
INVALID
high Data race on caller-supplied dst buffer after request timeout clientGetURLDeadline client.go
VALID
high Cookie attribute/header injection via unsanitized fields in AppendBytes Cookie.AppendBytes cookie.go
INVALID
high Set-Cookie injection in response cookie serializer appendResponseCookieBytes cookie.go
INVALID
high Missing delimiter and newline sanitization in cookie setters Cookie.SetKey/SetValue/SetDomain/SetPath cookie.go
INVALID
high Unbounded reflection of attacker-controlled request data enables denial of service requestHandler examples/helloworldserver/helloworldserver.go
INVALID
high Pooled response buffer reused before fasthttp finishes writing response NewFastHTTPHandler fasthttpadaptor/adaptor.go
INVALID
high Aliased fasthttp buffers can become stale or corrupted in the returned http.Request ConvertRequest fasthttpadaptor/request.go
INVALID
high Nil DialFunc returned when proxy setup fails FasthttpHTTPDialerTimeout fasthttpproxy/http.go
VALID
high Nil DialFunc returned when proxy setup fails (dual-stack) FasthttpHTTPDialerDualStackTimeout fasthttpproxy/http.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc FasthttpSocksDialer fasthttpproxy/socks5.go
INVALID
high Ignored proxy dialer initialization error can return nil or fail-open DialFunc in dual-stack variant FasthttpSocksDialerDualStack fasthttpproxy/socks5.go
INVALID
high Pending dial holds listener mutex and can deadlock Close DialWithLocalAddr fasthttputil/inmemory_listener.go
INVALID
high Goroutine and memory leak in serveFS: every ServeFS/ServeFSLiteral call spawns a non-terminating cleanup goroutine serveFS / ServeFS / ServeFSLiteral fs.go
INVALID
high Infinite loop in readLine when no newline remains readLine headerscanner.go
VALID
high Out-of-bounds read in skipSpace at buffer end skipSpace headerscanner.go
INVALID
high Decompression bomb via default no-limit BodyGunzip/BodyInflate/BodyUnbrotli/BodyUnzstd/BodyUncompressed BodyGunzip http.go
VALID
high Unbounded gzip decompression in MultipartFormWithLimit(0) streaming path MultipartFormWithLimit http.go
VALID
high IPv6 host validation bypass via bytes after first closing bracket validateIPv6Literal ipv6.go
INVALID
high Empty client list causes slice index out-of-range panic LBClient.get lbclient.go
INVALID
high Nil BalancingClient causes nil pointer dereference lbClient.DoDeadline lbclient.go
INVALID
high RemoveClients callback invoked while holding write lock can deadlock or lock permanently LBClient.RemoveClients lbclient.go
INVALID
high Unbounded per-IP counter map growth from retained zero-count entries perIPConnCounter.Unregister peripconn.go
VALID
high Unbounded DoS via attacker-controlled 'seconds' parameter on profile and trace endpoints PprofHandler pprofhandler/pprof.go
VALID
high Reset silently changes destination writer when stackless reset cannot execute (*writer).Reset stackless/writer.go
INVALID
high Stream writer goroutine lacks panic recovery and cleanup NewStreamReader stream.go
INVALID
high acquireRequestStream does not clamp prefetched bytes to ContentLength acquireRequestStream streaming.go
INVALID
high EOF detection in prefetched Content-Length read uses per-call n instead of totalBytesRead requestStream.Read streaming.go
INVALID
high Chunk size result is not validated before being used as a slice bound requestStream.Read streaming.go
INVALID
high Panic from comparing uncomparable any keys Set()/Get()/Remove() userdata.go
INVALID
high Unrecovered panic in worker goroutine can crash host or corrupt pool accounting workerFunc / getCh goroutine workerpool.go
INVALID
high Unbounded zstd decompression enables remote DoS via decompression bomb WriteUnzstd zstd.go
INVALID
medium Unsafe zero-copy string aliases mutable attacker-controlled buffer b2s b2s.go
INVALID
medium Out-of-range compression level is passed to brotli.NewWriterLevel and pooled under a normalized key acquireRealBrotliWriter brotli.go
INVALID
medium Nil pointer dereference panics in all public Do* entry points Do, DoTimeout, DoDeadline, DoRedirects (package-level, Client, HostClient) client.go
INVALID
medium Decompression bomb: no output size limit in public decompression API WriteGunzip / WriteInflate / AppendGunzipBytes / AppendInflateBytes compress.go
VALID
medium Cookie header injection in request cookie serializer appendRequestCookieBytes cookie.go
INVALID
medium ParseBytes can retain CRLF from raw input Cookie.ParseBytes cookie.go
INVALID
medium Host-header-controlled path rewrite when -vhost is enabled main examples/fileserver/fileserver.go
INVALID
medium Default fasthttp server is used without timeouts, body-size, or concurrency limits main examples/helloworldserver/helloworldserver.go
INVALID
medium Uncontrolled regular expression compilation from r query argument getExpvarRegexp expvarhandler/expvar.go
VALID
medium Unauthenticated exposure of all registered expvars ExpvarHandler expvarhandler/expvar.go
INVALID
medium Unbounded pre-Flush response buffering allows memory exhaustion writer.Write fasthttpadaptor/adaptor.go
INVALID
medium Wrapped handler panic is re-panicked in the fasthttp handler goroutine NewFastHTTPHandler fasthttpadaptor/adaptor.go
INVALID
medium Flush() can block forever after completion or hijack writer.Flush fasthttpadaptor/adaptor.go
INVALID
medium Zero-copy byte-to-string conversion aliases mutable fasthttp request buffers b2s fasthttpadaptor/b2s.go
INVALID
Page 1 of 4 · 179 total Next →
Arguments
{
  "paths": [
    "/home/ubuntu/sw/swesweep-fasthttp"
  ],
  "files_from": null,
  "re_triage": null,
  "report": null,
  "triage_levels": null,
  "skip_existing": false,
  "model": "qwen/qwen3.8-27b",
  "backend": "koscompute",
  "api_url": null,
  "openrouter_provider": null,
  "parallel": 4,
  "scan_parallel": null,
  "triage_parallel": null,
  "max_connections": null,
  "timeout": 600,
  "thinking": "medium",
  "thinking_scan": null,
  "thinking_triage": null,
  "retries": 20000,
  "max_chars": 350000,
  "extensions": ".go",
  "ignore_dirs": null,
  "skip_tests": true,
  "output_dir": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp",
  "triage_threshold": "medium",
  "triage_rounds": 5,
  "min_confidence": 0.0,
  "project": null,
  "repo_dir": null,
  "verbose_triage": false,
  "debug_info": null,
  "threat_model": "library",
  "custom_threat_model": null,
  "custom_threat_model_file": null,
  "threat_model_autodetect": true,
  "budget_usd": null,
  "deadline": null,
  "prices_file": null,
  "db": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp/scan.db",
  "resume": true,
  "summary_sections": {}
}
Threat model
{
  "profile": "library",
  "fingerprint": "00ff1b1a7b11",
  "sources": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "effective": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "warnings": [],
  "contradiction": null,
  "scan_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.",
  "triage_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.\nNot a vulnerability under this model: Missing parameter validation in non-public (internal, private, static) functions that are not directly reachable from outside when the public boundary already enforces the invariant; misuse that violates a documented precondition of the public API.\nVerdict rules: Trust invariants: the public API must validate all inputs. Non-public methods may assume invariants verified at the public boundary; do not report missing parameter validation in them as a security vulnerability unless the code is directly reachable from outside or a public path can deliver input that violates the invariant. A crash, memory corruption or unbounded resource use reachable through the public API with a crafted payload is VALID."
}