#chunked

infosec

• chunkloris: actix-web — HTTP/1.1 chunked transfer encoding. actix-web 4.x. verdict: vulnerable per chunk.
• chunkloris: Apache httpd (event MPM + mod_lua) — HTTP/1.1 chunked transfer encoding. Apache httpd (event MPM + mod_lua) 2.4.67. verdict: vulnerable per chunk.
• chunkloris: axum (on hyper) — HTTP/1.1 chunked transfer encoding. axum (on hyper) 0.7 / hyper 1.x. verdict: vulnerable per chunk.
• chunkloris: bandit — HTTP/1.1 chunked transfer encoding. bandit 1.11.1. verdict: vulnerable per chunk.
• chunkloris: cowboy — HTTP/1.1 chunked transfer encoding. cowboy 2.15.0 (cowlib 2.16.1, ranch 2.2.0). verdict: vulnerable per chunk.
• chunkloris: daphne — HTTP/1.1 chunked transfer encoding. daphne 4.x. verdict: vulnerable per chunk.
• chunkloris: express — HTTP/1.1 chunked transfer encoding. express 5.2.1. verdict: vulnerable per chunk.
• chunkloris: falcon (on async-http / protocol-http1) — HTTP/1.1 chunked transfer encoding. falcon (on async-http / protocol-http1) 0.49.0. verdict: vulnerable per chunk.
• chunkloris: fastify — HTTP/1.1 chunked transfer encoding. fastify 5.x. verdict: vulnerable per chunk.
• chunkloris: gin — HTTP/1.1 chunked transfer encoding. gin 1.10.1. verdict: vulnerable per chunk.
• chunkloris: granian — HTTP/1.1 chunked transfer encoding. granian 1.x. verdict: vulnerable per chunk.
• chunkloris: gunicorn — HTTP/1.1 chunked transfer encoding. gunicorn 23.0.0. verdict: vulnerable per chunk.
• chunkloris: HAProxy (with Lua applet for body sink) — HTTP/1.1 chunked transfer encoding. HAProxy (with Lua applet for body sink) 3.0.23. verdict: vulnerable per chunk.
• chunkloris: http/1 vs http/2 vs http/3 — how the per-chunk amplification shape changes (and does not change) across http/1.1 chunked transfer encoding, http/2 data frames, and http/3 data frames over quic
• chunkloris: hypercorn — HTTP/1.1 chunked transfer encoding. hypercorn 0.17.3. verdict: vulnerable per chunk.
• chunkloris: Kestrel — HTTP/1.1 chunked transfer encoding. Kestrel 9.0 (Microsoft.AspNetCore 9.0; bundled in mcr.microsoft.com/dotnet/aspnet:9.0). verdict: batches correctly.
• chunkloris: net/http (stdlib) — HTTP/1.1 chunked transfer encoding. net/http (stdlib) go-1.23.12. verdict: vulnerable per chunk.
• chunkloris: nginx (openresty distribution) — HTTP/1.1 chunked transfer encoding. nginx (openresty distribution) 1.29.2.3 / openresty:alpine. verdict: vulnerable per chunk.
• chunkloris: node http.Server (built-in) — HTTP/1.1 chunked transfer encoding. node http.Server (built-in) node-22.22.3. verdict: vulnerable per chunk.
• chunkloris: per-chunk http amplification — cross-ecosystem measurement of per-chunk / per-frame cpu cost in production http/1, http/2, http/3, and websocket servers under one-byte-per-chunk request bodies
• chunkloris: phoenix — HTTP/1.1 chunked transfer encoding. phoenix 1.7 on plug_cowboy 2.7 / cowboy 2.15.0. verdict: vulnerable per chunk.
• chunkloris: puma — HTTP/1.1 chunked transfer encoding. puma 6.4.3. verdict: vulnerable per chunk.
• chunkloris: Spring Boot + Tomcat — HTTP/1.1 chunked transfer encoding. Spring Boot + Tomcat spring-boot-3.3.5 / tomcat-10.1. verdict: vulnerable per chunk.
• chunkloris: tornado — HTTP/1.1 chunked transfer encoding. tornado 6.4.2. verdict: vulnerable per chunk.
• chunkloris: unicorn — HTTP/1.1 chunked transfer encoding. unicorn 6.1.0. verdict: vulnerable per chunk.
• chunkloris: uvicorn — HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.
• chunkloris: uvicorn — HTTP/1.1 chunked transfer encoding. uvicorn 0.32.1. verdict: vulnerable per chunk.
• chunkloris: Vert.x — HTTP/1.1 chunked transfer encoding. Vert.x 4.5.10. verdict: vulnerable per chunk.
• chunkloris: waitress — HTTP/1.1 chunked transfer encoding. waitress 3.0.2. verdict: vulnerable per chunk.