Skip to content

httputil: ResponseChain can exhaust or deadlock the buffer pool #799

Closed

Description

@dogancanbakir

ResponseChain can block forever on the httputil buffer pool:

  • NewResponseChain takes its two buffers one at a time. With N concurrent chains on an N-slot pool, each holds one slot and waits for the second.
  • FullResponse() takes a third pooled buffer that external callers cannot return (putBuffer is unexported), so every call leaks a slot until the pool is exhausted. Used by proxify and nuclei-internal-dast.

Surfaced in #793 (TestResponseChain_BurstWithPoolExhaustion hung once pool shrinking actually worked).

Activity

  1. added
    Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.
    on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions