Slop Shield triage board
Project slop-shield on GitLab · every number below is read live from the public GitLab API
21 reports triaged
Outcomes
6
Invented
a key claim is refuted with evidence
4
Wrong version
the code exists, at another version
3
Conclusion does not follow
the code is real, the conclusion is not
5
Confirmed
every key claim matches the code
3
Needs a human
could not be settled from code
To read by hand
Before Slop Shield
21
every incoming report is read in full by a maintainer
After Slop Shield
10
6 closed with evidence (a key claim refuted), 5 proposed to close: a maintainer confirms from the evidence note
Reports
| Issue | Report | Outcome | State |
|---|---|---|---|
| #2 | SS-R01 [flow proof] curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler rehearsal | Invented | closed |
| #3 | SS-S01 [flow proof] hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total syntheticneeds securityrehearsal | Confirmed | closed |
| #5 | SS-R03 [accept] curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer proposed closerehearsal | Conclusion does not follow | closed |
| #6 | SS-R05 [accept] curl 8.7.1: claimed buffer overflow from strcpy in the WebSocket handshake proposed closerehearsal | Wrong version | closed |
| #7 | SS-R08 [accept] QEMU 9p: claimed race on a fid path leading to guest escape needs securityrehearsal | Needs a human | closed |
| #8 | SS-S01 [accept] hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total syntheticneeds securityrehearsal | Confirmed | closed |
| #10 | SS-R01 [accept] curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler rehearsal | Invented | closed |
| #11 | SS-R03 [fix] curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer rehearsal | Invented | closed |
| #12 | SS-R08 [fix] QEMU 9p: claimed race on a fid path leading to guest escape needs securityrehearsal | Confirmed | closed |
| #13 | SS-R01 curl 8.13.0: claimed stack recursion in an HTTP/3 priority-frame handler | Invented | closed |
| #14 | SS-R02 curl (OS/400 port): claimed stack overflow from strcpy in an LDAP error-string helper proposed close | Wrong version | opened |
| #15 | SS-R03 curl (AmigaOS port): claimed heap overflow in the hostname resolver buffer | Invented | closed |
| #16 | SS-R04 curl: claimed NULL dereference through a binary-mode macro in a header that has moved proposed close | Wrong version | opened |
| #17 | SS-R05 curl 8.7.1: claimed buffer overflow from strcpy in the WebSocket handshake proposed close | Wrong version | opened |
| #18 | SS-R06 curl: claimed integer overflow in the cookie Max-Age overflow check proposed close | Conclusion does not follow | opened |
| #19 | SS-R07 curl: deep MIME nesting overflows the stack when the structure is freed needs security | Needs a human | opened |
| #20 | SS-R08 QEMU 9p: claimed race on a fid path leading to guest escape needs security | Confirmed | opened |
| #21 | SS-R09 GLib kqueue file monitor: claimed cancel-versus-rescan race leaving a stale pointer needs security | Needs a human | opened |
| #22 | SS-S01 hdrchunk 0.1.0: chunked decoder enforces the body limit per chunk, not in total syntheticneeds security | Confirmed | opened |
| #23 | SS-S02 hdrchunk 0.1.0: claimed heap overflow when copying long chunk extensions synthetic | Invented | closed |
| #24 | SS-S03 hdrchunk 0.1.0: claimed request smuggling through lenient chunk-size parsing syntheticproposed close | Conclusion does not follow | opened |
Confirmed report → fix
Merge request !6 Fix SS-S01: enforce max_body on the total of a chunked body (hdrchunk 0.1.1)
pipelines, oldest first: failed → success
pipelines, oldest first: failed → success
Releases
hdrchunk 0.1.1 (v0.1.1, 2026-10-20)
- Issue: decode_chunked enforced max_body on each chunk, not on the total body. A peer could send a body as many chunks, each under the limit, and the decoder returned a body larger than the caller allowed: memory use grew with the input instead of stopping at the configured limit.
- Weakness: CWE-770, Allocation of Resources Without Limits or Throttling.
- Affected versions: hdrchunk 0.1.0 (tag v0.1).
- Fixed version: hdrchunk 0.1.1 (tag v0.1.1).
- Severity (suggestion, a maintainer decides): Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3). Only availability is affected; the real impact depends on how much input the calling application buffers before it decodes.
- Fix: !6. decode_chunked now compares the running total with max_body before it accepts each chunk. Regression tests in lib/tests/test_chunked.py.
- Reproduction: the repro CI job runs a minimal test in a sandbox without network. It fails on 0.1.0 and passes on 0.1.1.
- Credit: reported via Slop Shield demo report SS-S01, synthetic (#8). The confidential tracking issue is #9.
Rehearsal runs are included in the counts. Hide them.