Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

python-trio/trio

              main @ 0db3cf4
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

trio/_ssl.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Simultaneous send/recv calls on an un-handshook SSLStream can initiate concurrent TLS handshakes, causing protocol confusion and potentially establishing unencrypted or bypassable sessions. Ensure strict serialization of the handshake state before permitting I/O.

Denial of Service: A deadlock vulnerability exists in TLS 1.3 server handshakes when using OpenSSL due to premature sending of session tickets. Delaying ticket transmission until the first write prevents handshake blocks.

Denial of Service: Cancelled tasks waiting on CapacityLimiter to acquire tokens can leak memory indefinitely if not properly discarded during cancellation. Always ensure cancellation handlers clean up pending state queues.