Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kludex/uvicorn
main @ e8a31bc
7
Fixes
3
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
uvicorn.middleware.proxy_headers: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Flaws in parsing and traversing the X-Forwarded-For header chain allowed attackers to spoof client IP addresses, potentially bypassing upstream IP-based access controls and authentication mechanisms.
Denial of Service: A race condition involving shared protocol-level ASGI message events allowed concurrent requests to deadlock the server, causing Uvicorn to hang completely.
HTTP Response Splitting: Inadequate regex validation in header name parsing allowed unescaped control sequences to pass into responses, enabling HTTP response splitting and arbitrary header injection (as tracked in CVE-2020-7695).