Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

magicstack/httptools

              master @ cf10ce6
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

HTTP Request Smuggling: 3 prior fixes. Scrutinize any change in this area.

httptools/_version.py: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Directly wraps the llhttp parser; the only fix touching this component addressed CVE-2024-27982 and introduced opt-in leniency flags, making it the highest-risk surface for smuggling.

HTTP Request Smuggling: Version file pins the bundled llhttp parser; two fixes here show that outdated parser versions directly translate to smuggling vulnerabilities (CVE-2022-32213/14/15 and CVE-2021-22959/60).