swesweep-fasthttp

/home/ubuntu/sw/swesweep-fasthttp

Repository: https://github.com/valyala/fasthttp.git
Commit: e9208ecebf0c102176bb0635043c17333b10401d
Branch: –
Created: 2026-10-17 17:58 UTC

Files scanned: 78

Runs

Run	State	Model	Triage model	Files	Findings	Cost	Started (UTC)
#4	completed	qwen/qwen3.8-27b	qwen/qwen3.8-27b	78 / 78	179	$7.75	2026-10-17 19:50
#3	interrupted	qwen/qwen3.8-27b	qwen/qwen3.8-27b	0 / 78	0	–	2026-10-17 19:36
#2	interrupted	qwen/qwen3.8-27b	qwen/qwen3.8-27b	0 / 78	0	–	2026-10-17 18:02
#1	interrupted	qwen/qwen3.8-27b	qwen/qwen3.8-27b	0 / 78	0	–	2026-10-17 17:58

Findings

Severity	Title	File	Triage
critical	Integer overflow in chunked Transfer-Encoding chunk size causes panic (remote DoS) readBodyChunked	http.go	VALID
critical	appendBodyFixedSize lacks negative-size guard, panics on negative n appendBodyFixedSize	http.go	INVALID
critical	Content-Length stream can consume bytes beyond the declared body length requestStream.Read	streaming.go	VALID
high	Unsafe string conversion aliases mutable attacker-controlled bytes b2s	b2s.go	INVALID
high	Out-of-range compression level forwarded to brotli.NewWriterLevel acquireRealBrotliWriter / acquireStacklessBrotliWriter	brotli.go	INVALID
high	Unbounded decompression (decompression bomb) in WriteUnbrotli / AppendUnbrotliBytes WriteUnbrotli / AppendUnbrotliBytes	brotli.go	VALID
high	Unbounded brotli decompression can exhaust memory WriteUnbrotli	brotli.go	VALID
high	Ignored stackless deferred-execution return value can cause a data race in brotli compression stacklessWriteBrotli	brotli.go	INVALID
high	Data race on caller-supplied dst buffer after request timeout clientGetURLDeadline	client.go	VALID
high	Cookie attribute/header injection via unsanitized fields in AppendBytes Cookie.AppendBytes	cookie.go	INVALID
high	Set-Cookie injection in response cookie serializer appendResponseCookieBytes	cookie.go	INVALID
high	Missing delimiter and newline sanitization in cookie setters Cookie.SetKey/SetValue/SetDomain/SetPath	cookie.go	INVALID
high	Unbounded reflection of attacker-controlled request data enables denial of service requestHandler	examples/helloworldserver/helloworldserver.go	INVALID
high	Pooled response buffer reused before fasthttp finishes writing response NewFastHTTPHandler	fasthttpadaptor/adaptor.go	INVALID
high	Aliased fasthttp buffers can become stale or corrupted in the returned http.Request ConvertRequest	fasthttpadaptor/request.go	INVALID
high	Nil DialFunc returned when proxy setup fails FasthttpHTTPDialerTimeout	fasthttpproxy/http.go	VALID
high	Nil DialFunc returned when proxy setup fails (dual-stack) FasthttpHTTPDialerDualStackTimeout	fasthttpproxy/http.go	INVALID
high	Ignored proxy dialer initialization error can return nil or fail-open DialFunc FasthttpSocksDialer	fasthttpproxy/socks5.go	INVALID
high	Ignored proxy dialer initialization error can return nil or fail-open DialFunc in dual-stack variant FasthttpSocksDialerDualStack	fasthttpproxy/socks5.go	INVALID
high	Pending dial holds listener mutex and can deadlock Close DialWithLocalAddr	fasthttputil/inmemory_listener.go	INVALID
high	Goroutine and memory leak in serveFS: every ServeFS/ServeFSLiteral call spawns a non-terminating cleanup goroutine serveFS / ServeFS / ServeFSLiteral	fs.go	INVALID
high	Infinite loop in readLine when no newline remains readLine	headerscanner.go	VALID
high	Out-of-bounds read in skipSpace at buffer end skipSpace	headerscanner.go	INVALID
high	Decompression bomb via default no-limit BodyGunzip/BodyInflate/BodyUnbrotli/BodyUnzstd/BodyUncompressed BodyGunzip	http.go	VALID
high	Unbounded gzip decompression in MultipartFormWithLimit(0) streaming path MultipartFormWithLimit	http.go	VALID
high	IPv6 host validation bypass via bytes after first closing bracket validateIPv6Literal	ipv6.go	INVALID
high	Empty client list causes slice index out-of-range panic LBClient.get	lbclient.go	INVALID
high	Nil BalancingClient causes nil pointer dereference lbClient.DoDeadline	lbclient.go	INVALID
high	RemoveClients callback invoked while holding write lock can deadlock or lock permanently LBClient.RemoveClients	lbclient.go	INVALID
high	Unbounded per-IP counter map growth from retained zero-count entries perIPConnCounter.Unregister	peripconn.go	VALID
high	Unbounded DoS via attacker-controlled 'seconds' parameter on profile and trace endpoints PprofHandler	pprofhandler/pprof.go	VALID
high	Reset silently changes destination writer when stackless reset cannot execute (*writer).Reset	stackless/writer.go	INVALID
high	Stream writer goroutine lacks panic recovery and cleanup NewStreamReader	stream.go	INVALID
high	acquireRequestStream does not clamp prefetched bytes to ContentLength acquireRequestStream	streaming.go	INVALID
high	EOF detection in prefetched Content-Length read uses per-call n instead of totalBytesRead requestStream.Read	streaming.go	INVALID
high	Chunk size result is not validated before being used as a slice bound requestStream.Read	streaming.go	INVALID
high	Panic from comparing uncomparable any keys Set()/Get()/Remove()	userdata.go	INVALID
high	Unrecovered panic in worker goroutine can crash host or corrupt pool accounting workerFunc / getCh goroutine	workerpool.go	INVALID
high	Unbounded zstd decompression enables remote DoS via decompression bomb WriteUnzstd	zstd.go	INVALID
medium	Unbounded query-string allocation and retained pool capacity Args.ParseBytes	args.go	in_progress
medium	Unsafe zero-copy string aliases mutable attacker-controlled buffer b2s	b2s.go	INVALID
medium	Write errors silently swallowed in stackless compression path WriteBrotliLevel / nonblockingWriteBrotli	brotli.go	INVALID
medium	Out-of-range compression level is passed to brotli.NewWriterLevel and pooled under a normalized key acquireRealBrotliWriter	brotli.go	INVALID
medium	Nil pointer dereference panics in all public Do* entry points Do, DoTimeout, DoDeadline, DoRedirects (package-level, Client, HostClient)	client.go	INVALID
medium	Decompression bomb: no output size limit in public decompression API WriteGunzip / WriteInflate / AppendGunzipBytes / AppendInflateBytes	compress.go	VALID
medium	Cookie header injection in request cookie serializer appendRequestCookieBytes	cookie.go	INVALID
medium	ParseBytes can retain CRLF from raw input Cookie.ParseBytes	cookie.go	INVALID
medium	Host-header-controlled path rewrite when -vhost is enabled main	examples/fileserver/fileserver.go	INVALID
medium	Default fasthttp server is used without timeouts, body-size, or concurrency limits main	examples/helloworldserver/helloworldserver.go	INVALID
medium	Uncontrolled regular expression compilation from r query argument getExpvarRegexp	expvarhandler/expvar.go	VALID