| low |
WriteGzipLevel / WriteDeflateLevel return input length instead of compressed byte count for non-blocking writers WriteGzipLevel / WriteDeflateLevel |
compress.go |
–
|
| low |
Ignored error on fallback compression writer creation can yield nil writer acquireRealGzipWriter / acquireRealDeflateWriter |
compress.go |
–
|
| low |
Max-Age integer wrap can alter cookie lifetime Cookie.ParseBytes |
cookie.go |
–
|
| low |
Parsed SameSite and Partitioned attributes bypass safety invariants Cookie.ParseBytes |
cookie.go |
–
|
| low |
Quote-unaware cookie scanner truncates values cookieScanner.next/nextRaw |
cookie.go |
–
|
| low |
Unbounded remote response body can exhaust memory main |
examples/client/client.go |
–
|
| low |
Attacker-controlled response body printed directly to output sendGetRequest |
examples/client/client.go |
–
|
| low |
Empty JSON body treated as successful parse sendPostRequest |
examples/client/client.go |
–
|
| low |
Directory index generation enabled by default can leak file names main |
examples/fileserver/fileserver.go |
–
|
| low |
Unauthenticated /stats endpoint exposes expvar statistics requestHandler |
examples/fileserver/fileserver.go |
–
|
| low |
Reflected request fields are served without cache and MIME-sniffing hardening requestHandler |
examples/helloworldserver/helloworldserver.go |
–
|
| low |
Ignored URI parse error main |
examples/host_client/hostclient.go |
–
|
| low |
Hardcoded credentials sent to local endpoint main |
examples/host_client/hostclient.go |
–
|
| low |
Missing explicit client timeouts and resource bounds main |
examples/host_client/hostclient.go |
–
|
| low |
Raw response body printed to stdout main |
examples/host_client/hostclient.go |
–
|
| low |
Unbounded expvar response generation ExpvarHandler |
expvarhandler/expvar.go |
–
|
| low |
Raw expvar values inserted into JSON response without validation ExpvarHandler |
expvarhandler/expvar.go |
–
|
| low |
Hijack after Flush can interleave writes on the same connection writer.Hijack |
fasthttpadaptor/adaptor.go |
–
|
| low |
Hijack path does not release buffered writer resources writer.Hijack |
fasthttpadaptor/adaptor.go |
–
|
| low |
Late ResponseWriter writes can race with released pooled buffers writer.Write |
fasthttpadaptor/adaptor.go |
–
|
| low |
Unvalidated proxy path component injected into socket address addrAndAuth |
fasthttpproxy/dialer.go |
–
|
| low |
TLS/HTTP proxy selection based on ':443' port suffix heuristic GetDialFunc (slow-path closure) |
fasthttpproxy/dialer.go |
–
|
| low |
Convenience dialers default to no timeout FasthttpHTTPDialer |
fasthttpproxy/http.go |
–
|
| low |
Dial creates a client connection with a nil local address Dial |
fasthttputil/inmemory_listener.go |
–
|
| low |
Caller-supplied net.Addr implementations are trusted and can cause side-effect DoS SetLocalAddr |
fasthttputil/inmemory_listener.go |
–
|
| low |
Queued attacker data can be read after a read deadline has expired readNextByteBuffer |
fasthttputil/pipeconns.go |
–
|
| low |
Empty writes can produce Read returns of 0, nil Write, Read |
fasthttputil/pipeconns.go |
–
|
| low |
Data race on writeDeadlineCh between Write and SetWriteDeadline Write, SetWriteDeadline |
fasthttputil/pipeconns.go |
–
|
| low |
Mutable unsafe aliasing of string data s2b |
fasthttputil/s2b.go |
–
|
| low |
Unbounded growth of global filesLockMap sync.Map getFileLock / compressAndOpenFSFile |
fs.go |
–
|
| low |
VisitHeaderParams passes unvalidated bytes through escape handling VisitHeaderParams |
header.go |
–
|
| low |
Unbounded trailer accumulation via direct AddTrailerBytes calls AddTrailerBytes |
header.go |
–
|
| low |
Valid IPv4-embedded IPv6 addresses with '::' immediately before the IPv4 tail are rejected validateIPv6Literal |
ipv6.go |
–
|
| low |
RemoveClients accepts nil callback and panics without releasing lock LBClient.RemoveClients |
lbclient.go |
–
|
| low |
Exported field mutation can race with AddClient and Do LBClient.AddClient |
lbclient.go |
–
|
| low |
Nil serve callback causes child process panic Prefork.ListenAndServe |
prefork/prefork.go |
–
|
| low |
New(nil) panics due to unchecked fasthttp.Server pointer New |
prefork/prefork.go |
–
|
| low |
FASTHTTP_PREFORK_CHILD environment variable can force child-mode behavior IsChild |
prefork/prefork.go |
–
|
| low |
Child listener blindly trusts file descriptor 3 Prefork.listen |
prefork/prefork.go |
–
|
| low |
File descriptor and listener leaks in prefork setup Prefork.setTCPListenerFiles |
prefork/prefork.go |
–
|
| low |
RecoverThreshold can allow unbounded child respawn under child-crash conditions Prefork.prefork |
prefork/prefork.go |
–
|
| low |
Fragile SO_REUSEPORT detection based on error-text substring match Listen |
reuseport/reuseport.go |
–
|
| low |
Setsockopt errors can be silently discarded listenConfig.Control |
reuseport/reuseport_aix.go |
–
|
| low |
Setsockopt failures are not propagated from listenConfig.Control listenConfig.Control |
reuseport/reuseport_solaris.go |
–
|
| low |
Listen does not validate that network is a TCP network Listen |
reuseport/reuseport_solaris.go |
–
|
| low |
SetsockoptInt error can be silently discarded in the Control callback Control closure in listenConfig.Control, invoked by reuseport.Listen |
reuseport/reuseport_windows.go |
–
|
| low |
Concurrency slot leak when handler panics in TimeoutWithCodeHandler TimeoutWithCodeHandler |
server.go |
–
|
| low |
Nil handler in ServeConn causes panic on first request ServeConn (package-level) |
server.go |
–
|
| low |
Resource leak (br/bw/ctx) on handler panic in serveConn Server.serveConn |
server.go |
–
|
| low |
No timeout, cancellation, or execution bound for f funcWorker |
stackless/func.go |
–
|