Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

seanmonstar/httparse

              master @ e48b248
            

Fixes

CVEs

HIGH

Peak severity

Highlights

HTTP Request Smuggling: 2 prior fixes. Scrutinize any change in this area.

src/lib.rs: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Lenient character validation in token parsing (such as allowing leading spaces in HTTP methods) permits malformed headers to pass, exposing downstream proxies to request smuggling.

HTTP Request Smuggling: Discrepancies between signed and unsigned byte comparisons in AVX2/SSE2 vector paths can lead to incorrect validation of headers with characters >= 0x80.

Integer Overflow: Unbounded iteration or missing input length constraints when processing hex strings during chunk size parsing can overflow internal integer representations.