1.2 KiB
1.2 KiB
UNDF: UNDF-2026-000000424
hypercorn — CWE-407 Scan: CLEAN
Date: 2026-03-27
Scope: Full Python codebase (src/hypercorn/)
Findings
No CWE-407 defects confirmed.
Patterns examined
| Location | Pattern | Verdict |
|---|---|---|
hypercorn/utils.py:filter_pseudo_headers |
single-pass over headers list | CLEAN — O(H), no inner scan |
hypercorn/utils.py:build_and_validate_headers |
single-pass over headers list | CLEAN — O(H), no inner scan |
hypercorn/protocol/http_stream.py:160,206,232 |
for name, value in scope["headers"] with break |
CLEAN — O(H) early-exit scans, not nested |
hypercorn/protocol/h2.py |
HTTP/2 stream management via dict[int, stream] |
CLEAN — dict-keyed by stream_id, O(1) lookup |
hypercorn/middleware/dispatcher.py |
for path, app in self.mounts.items() |
CLEAN — mount table is small and bounded |
hypercorn/config.py:response_headers |
for alt_svc_header in self.alt_svc_headers |
CLEAN — alt_svc_headers bounded (1-2 entries typical) |
Conclusion
Hypercorn uses single-pass header iterations throughout and relies on dicts for stream management. No quadratic patterns found.