Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

encode/httpcore

              master @ 10a6582
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

Denial of Service: 6 prior fixes. Scrutinize any change in this area.

httpcore/_async/http_proxy.py: most-fixed (7 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Proxy Request Smuggling: Three separate fixes address request smuggling via CONNECT tunneling, connection reuse, and incomplete body reads, indicating a persistent risk area where proxy semantics can be violated.

Denial of Service: Missing timeouts on CONNECT requests and socket leaks on tunnel failure can lead to hangs and resource exhaustion; both async and sync paths are affected.

Denial of Service: Multiple race conditions around connection removal and response closing can corrupt pool state or leak connections, leading to resource exhaustion.