Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Netflix/zuul

              master @ 5ca93b1
            

Fixes

CVEs

CRITICAL

Peak severity

41.7%

Coverage

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

zuul-core/src/main/java/com/netflix/zuul/filters/endpoint/ProxyEndpoint.java: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Request Smuggling: Premature session completion on 1xx responses allows connection reuse with incomplete responses, enabling request smuggling between clients.

Auth Bypass: Connection leak from mishandling informational statuses can cause responses to be routed to the wrong client, bypassing authentication boundaries.

Parameter Injection: Decoding query parameters before splitting on '&' allows injected ampersands to create hidden parameters, altering origin request semantics.