1 KiB
1 KiB
UNDF: UNDF-2026-000000451
lighttpd — CWE-407 scan result: CLEAN
Scan date: 2026-03-27
Files scanned
| File | Finding |
|---|---|
src/connections.c |
CLEAN — chunk-type scan in connection_write_chunkqueue is a single-pass linear traversal, not a nested membership test |
src/plugin.c |
CLEAN (startup-only) — plugins_load nested loop is O(M×F) at startup only, where F is a compile-time fixed-size static table; not per-request |
Notes
plugins_load contains an outer loop over configured modules and an inner
strcmp scan over a static load_functions[] array. This is startup-only
(runs once at server init) and F is bounded by the number of compiled-in
modules (fixed at build time, typically < 100). This does not meet the CWE-407
threshold for a ticketed defect.
connection_write_chunkqueue scans from cq->first forward to find the
first non-MEM_CHUNK element for TCP_CORK optimisation. This is a single
linear pass per write call, not a nested O(N²) membership test.
Verdict: CLEAN