Issues

• Response parser accepts status codes 600-999

  bugsecurity
  dotnet-web-stack/Glyph11#73 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Native build hardening absent (no stack protector, fortify, hidden visibility; exports everything)

  security
  dotnet-web-stack/Glyph11#72 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Bad HTTP-version maps to 505 in C# but 400 in the C core

  bugsecurity
  dotnet-web-stack/Glyph11#71 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Native sequence overload demands scratch buffer >= entire input, body included

  bugsecurity
  dotnet-web-stack/Glyph11#70 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Pico's leniencies (bare LF, obs-fold, leading CRLF) create desync differentials

  bugsecurity
  dotnet-web-stack/Glyph11#69 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Host header validation is weak: empty value and printable junk pass

  security
  dotnet-web-stack/Glyph11#68 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Duplicate Content-Length: BodyFramingDetector and ContentLengthBodyReader disagree (last-wins vs first-wins)

  bugsecurity
  dotnet-web-stack/Glyph11#67 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Pico silently truncates requests with 257-512 headers and misclassifies >512 as incomplete

  bugsecurity
  dotnet-web-stack/Glyph11#66 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Multi-segment input is fully copied (body included) before header limits are enforced

  bugsecurity
  dotnet-web-stack/Glyph11#65 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Managed parsers never clear the request: stale headers bleed across keep-alive requests

  bugsecurity
  dotnet-web-stack/Glyph11#64 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Chunked decoding has no resource ceiling: unbounded chunk buffering and unlimited trailers

  bugsecurity
  dotnet-web-stack/Glyph11#63 · Filter by author Kaliumhexacyanoferrat opened on Oct 30, 2026

• Chunk sizes of 2^63 or more go negative: truncated, re-read as framing, or ArgumentOutOfRangeException

  dotnet-web-stack/Glyph11#62 · Filter by author MDA2AV opened on Oct 30, 2026

• A Content-Length of 2^63 or more is accepted, then framed as no body

  dotnet-web-stack/Glyph11#61 · Filter by author MDA2AV opened on Oct 30, 2026

• Content-Length with whitespace before a list comma (5 ,5) is accepted, then framed as no body

  dotnet-web-stack/Glyph11#60 · Filter by author MDA2AV opened on Oct 30, 2026

• LF-only messages read as incomplete forever; bare-LF strictness is unreachable

  dotnet-web-stack/Glyph11#59 · Filter by author MDA2AV opened on Aug 12, 2026

• bytesReadCount is one less than the bytes consumed, and the doc says otherwise

  dotnet-web-stack/Glyph11#58 · Filter by author MDA2AV opened on Aug 12, 2026
  1

• Drop the Kotlin bindings; bring the C core level with the managed parser

  dotnet-web-stack/Glyph11#57 · Filter by author MDA2AV opened on Aug 12, 2026