Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
netflix/feign
master @ 65b42b8
2
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Request Smuggling: 1 prior fix. Scrutinize any change in this area.
core/src/main/java/feign/Request.java: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Request Smuggling: Content-Length was computed from an untrusted user-provided value, allowing an attacker to smuggle requests by mismatching the declared and actual body length. The fix derives length from real bytes, but any new code that builds requests must replicate this.
XXE: Both XML decoders parsed attacker-controlled response bodies without disabling external entities, DTDs, or parameter entities, enabling file disclosure or SSRF. The fix disables these via SAX features, but any future XML parser must be hardened similarly.