httptools / llhttp critical CVE's

[nlsj1985]

Hi,

I just want to raise your attention on the critical CVE's (9.1 score) that have been reported recently in llhttp by the nodeJS project, and are raised by me in the httptools project.

Please note that there's some controversie (it seems) about mandating CR delimited headers and dropping support for LF delimited headers in the release of llhttp.

As I'm not sure how this impacts projects using httptools and llhttp, I've raised this as an issue in the httptools project.
[https://github.com/MagicStack/httptools/issues/82]

Perhaps some of you can contribute and help get some sense out of what's needed to get this fixed for all beautiful things running on uvicorn.

Thanks!
SJ

[Kludex]

httptools was bumped on uvicorn. Thanks. 👍