Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

embedthis/goahead

              main @ 59ec3fe
            

Fixes

CVEs

CRITICAL

Peak severity

40.7%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

src/http.c: most-fixed (15 issues). Treat as high-risk during review.

31 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Request Smuggling: Multiple framing defects (CL/TE ambiguity, integer overflow, chunk size mishandling) enable request smuggling and body-streaming abuse; each fix addresses a distinct parsing path.

Auth Bypass: Authentication bypasses span digest nonce weaknesses, fail-open auth store configuration, post-deny handler dispatch, and TLS client certificate verification gaps.

Use-After-Free: Lifecycle mismatches free objects while still referenced (CGI registry, sessions, script variables), leading to UAF/double-free.