Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ithewei/libhv

              master @ bb675b8
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

HTTP Request Smuggling: 2 prior fixes. Scrutinize any change in this area.

examples/socks5_proxy_server.c: most-fixed (1 issue). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Inconsistent processing of Transfer-Encoding and Content-Length headers can cause downstream parsers to desynchronize. The parsing logic must enforce single, well-defined transfer encoding rules.

HTTP Response Splitting: Unescaped CRLF characters in HTTP header values allow attackers to terminate headers prematurely and inject arbitrary payloads, causing response splitting or cache poisoning.

Path Traversal: The static file handler's reliance on custom directory traversal checks rather than robust path canonicalization can expose sensitive system files to unauthorized download.