Security

This page covers simoom's security model, its limits and defaults, what was tested and with what results, the known gaps, and how to report a vulnerability.

Last hardening pass: 2026-11-07, against head 33ee716 plus the fixes listed below. Third-party suites: 2026-11-09, against head bf24f89 plus bugs 16 to 22 below.

Reporting a vulnerability

Please report vulnerabilities privately through GitHub security advisories: https://github.com/Cameleering/simoom/security/advisories/new. Don't open a public issue, pull request or discussion for a suspected vulnerability.

• Include the version or commit, the feature set (http1, http2, tls, http3...), the operating system and back end, and a reproducer: bytes on the wire are ideal.
• We aim to acknowledge a report within 3 working days and to agree a fix and disclosure date with you within 14 days. The default embargo is 90 days or the release of a fix, whichever comes first.
• Fixes ship as a patch release with a GitHub advisory (and a RustSec advisory once the crates are on crates.io). Reporters are credited unless they ask not to be.
• Hardening ideas that aren't vulnerabilities (a stricter default, a new limit) are welcome as normal issues.

Security model

simoom is an embeddable HTTP/1.1, HTTP/2 and HTTP/3 origin server engine. It isn't a reverse proxy, a forward proxy, a tunnel or a static-file server. The service (the embedding application) is trusted. Everything that arrives from the network is untrusted, including the bytes forwarded by a front proxy.

What simoom guarantees to the service:

• Memory safety. Every crate except simoom-sys is #![forbid(unsafe_code)]. simoom-sys holds the operating-system calls, SIMD scanning and crypto intrinsics, and every unsafe block there has a SAFETY: comment. There are no external crates, so there is no third-party code in the dependency tree.
• Strict parsing per RFC 9110, 9112, 9113, 7541, 9114 and 9204. Any message whose framing is ambiguous is refused, and the connection is closed after a framing error, so request boundaries can't be shifted (no request smuggling).
• Bounded resources. Every per-connection and per-stream structure has a limit, and exceeding it gives a specific status code or a connection close plus a counter in ServerHandle::stats().
• Constant-time crypto. TLS 1.3 only, with hardware AES-GCM or a bitsliced fallback, and ct_eq for every secret comparison. Certificate verification can't be turned off, and 0-RTT is off.

HTTP/1.1 framing decisions

• A request with both Transfer-Encoding and Content-Length is refused (400), as is any Transfer-Encoding other than a single final chunked. So are duplicate or differing Content-Length values and a Content-Length with a sign, a list, spaces or hex.
• Bare CR, bare LF line endings, obs-fold, NUL and other control bytes, whitespace before a colon, and invalid chunk sizes are refused. Chunk extensions are parsed to the grammar, including BWS before ;.
• Expect: 100-continue follows RFC 9110 §10.1.1, and any other expectation gets 417. An Upgrade: h2c that carries a body is ignored (served as HTTP/1.1).
• CONNECT is answered by the service, and then the connection is closed. simoom is not a tunnel, and a front proxy that sees a 2xx switches to tunnelling, so nothing after a CONNECT head is ever parsed as another request (fixed in this pass).
• Absolute-form targets (GET http://host/path): the authority comes from the target and Host is ignored (RFC 9112 §3.2.2). Request::host() returns the target's authority and Request::target()/path() return the path and query. A target with userinfo (http://user@host/) is refused (RFC 9110 §4.2.4). Both were fixed in this pass.
• For internal traffic, the recommended upstream protocol is HTTP/2 (h2c with prior knowledge), which avoids HTTP/1.1 framing ambiguity altogether.

Limits and defaults

Every limit is a field of simoom::Limits (plan §7.1), and crates/simoom/tests/limits.rs checks the defaults.

HTTP/2 frame budgets (Limits::h2_frame_budgets, per 10 s sliding window per connection; GOAWAY ENHANCE_YOUR_CALM beyond them):

• RST_STREAM received 200 and caused 200 (Rapid Reset, MadeYouReset);
• PING 100;
• SETTINGS 100;
• empty frames 200;
• PRIORITY;
• WINDOW_UPDATE frames under 1 KiB;
• at most max_continuation_frames CONTINUATION frames per block.

Each is configurable (u32::MAX turns one off).

TLS: TLS 1.3 only. Groups X25519 and P-256. Suites AES-128-GCM, AES-256-GCM and ChaCha20-Poly1305. More than 32 records in a row that carry no application data (empty records, warning alerts, KeyUpdates) is fatal. Rejected 0-RTT data is skipped only up to 64 KiB.

QUIC:

• Retry is used once the handshaking connections pass a threshold, and connections are capped in total.
• The 3x amplification limit is enforced.
• The connection-ID retirement queue and the out-of-order CRYPTO and STREAM buffers are all bounded.
• Packet numbers are skipped at random to detect optimistic ACKs.

What was tested (2026-11-07)

Third-party code was limited to tools already on the machine and Ubuntu 24.04 archive packages. The archive packages were extracted without root from apt-get download: nginx 1.24.0, haproxy 2.8.30, nghttp2-client 1.59.0 (nghttp, h2load) and gnutls-bin 3.8.3.

nghttp notes, both by design:

• A 1 MB POST without Content-Length streams through a BodySource. A service that answers without reading it gets an early 200 and an RST_STREAM(NO_ERROR), as RFC 9113 §8.1 allows.
• nghttp -w 1 -W 1 (2-byte windows) trips the small WINDOW_UPDATE budget (data dribble, CVE-2019-9511), so the connection gets GOAWAY ENHANCE_YOUR_CALM.

TLS interop covered:

• the TLS 1.3 handshake with chain verification;
• -tls1_2 and -tls1_1 refused with a protocol_version alert;
• bad SNI (default certificate), no SNI, no ALPN, ALPN h2 and http/1.1, and an unknown ALPN (no_application_protocol);
• X25519 and P-256 work. P-384, P-521, X448 and ffdhe get a clean handshake_failure, and X448 then X25519 goes through HelloRetryRequest. On OpenSSL 3.5, the X25519MLKEM768 hybrid falls back to X25519;
• all three suites;
• client certificates: good, rogue (unknown_ca), and missing (certificate_required);
• KeyUpdate both ways, PSK resumption, and 0-RTT offered and rejected.

Coverage-guided fuzzing

Plan §7.3 option F2 is implemented and works on stable Rust on Linux. The callbacks are in simoom-sys/src/sancov.rs, behind the test-only feature sancov; there are no dependencies. LLVM's sancov-module pass, run through -C passes, calls __sanitizer_cov_trace_pc_guard. coverage_guided keeps a corpus of inputs that reach new edges, using AFL-style hit-count buckets. Its mutator is the harness's own byte mutations plus corpus splicing. Every input is checked for split invariance and against the reference RFC 9112 parser.

• First run: 171k executions per minute, 1,140 of 3,036 instrumented edges in 60 s.
• Longer runs: 3 seeds × 10 min, recorded under "Results" below.
• Windows: the MSVC back end refuses the instrumented COMDATs ("Associative COMDAT symbol does not exist"), so it runs only on Linux.
• Not done yet: corpus minimisation, the HTTP/2, QUIC and TLS targets (they need only a driver like the http1 one), and persisting the corpus between runs.

RUSTFLAGS="-C passes=sancov-module -C llvm-args=-sanitizer-coverage-level=3 \
  -C llvm-args=-sanitizer-coverage-trace-pc-guard" SIMOOM_FUZZ_SECS=600 \
  cargo test --release -p simoom-http1 --features sancov --test fuzz coverage_guided -- --nocapture

Results

Three 10-minute runs (seeds 11, 22, 33; WSL2 Ubuntu 24.04, release, one thread): 1.37M, 1.67M and 1.81M executions, corpora of 1,858 to 1,895 inputs, 1,220 to 1,232 of 3,036 instrumented edges (the remainder is mostly response parsing, WebSocket and the serializer, which this driver doesn't exercise). No split-invariance or differential failure, no panic. Coverage plateaus after about 5 minutes, so longer runs need new targets more than more time.

Third-party suites (2026-11-09)

Approved by the owner on 2026-11-08 ("Yes, allow them"). Every suite ran in WSL2 (Ubuntu 24.04) or in Docker (Docker Desktop 29.9.2 through the WSL integration), from scratch directories under ~/simoom-sec-tools/ outside the repository, at pinned versions. None is a dependency of any simoom crate. The simoom servers were built from the working tree in pinned images: rust:1.99.1-slim-trixie@sha256:7eab7ce1…3cd5 for the build, debian:trixie-slim@sha256:a72b4433…b6b2 (HTTP Garden) and the runner's endpoint image (QUIC) for the run.

h2spec

h2spec §3.5/2 sends INVALID CONNECTION PREFACE\r\n\r\n and expects a connection close (GOAWAY allowed). On the shared HTTP/1.1 + h2c port simoom read it as an HTTP/1 request and answered 400, which h2spec reads as a malformed frame. Now (bug 16), on an h2c-enabled listener, the first bytes of a connection go to the HTTP/2 codec, which answers SETTINGS and GOAWAY(PROTOCOL_ERROR) and closes (RFC 9113 §3.4), when either:

• they start with the preface's request line PRI * HTTP/2.0 but the rest of the preface is wrong; or
• the first request line fails with an invalid version and its last word has no HT prefix and no /: nothing in it is HTTP/1 in any form.

HTTP/1 clients with a damaged version (HTTP/1.x, HT?P/1.1, XTTP/1.1, HTTP/0.9's GET /) still get a 400, and later requests on a connection are never treated as a preface. The HTTP Garden's mutator found the first, too broad version of the rule (any line without HTTP/), which answered HT\xbcP/1.1 with GOAWAY, and the narrower rule replaced it.

Repeated runs then showed generic §3.8/1 ("Sends a GOAWAY frame", GOAWAY then PING) failing with "connection reset by peer" in about 1 run in 5: the server closed as soon as it read the peer's GOAWAY, and when the PING came in a later read it hit a closed socket. Fixed as bug 22 (the server answers a GOAWAY with its own graceful shutdown); results after it are in the matrix section below.

HTTP Garden

simoom joined the Garden as an origin (conformance_server --garden answers with the Garden's echo format: base64 JSON of the method, version, target, headers and body; image images/simoom/Dockerfile in the Garden checkout). Its probed quirk is allows-http-2: true. The Garden removed its fuzzing driver upstream (commit 5e260b6), so a small driver (tools/simoom_fuzz.py, adapted from the removed fuzz.py) runs the Garden's own mutator (mutations.py) and classifier (diff.categorize_discrepancy), fans every mutated stream out to all origins, and replays every kept result through each transducer.

• Differential fuzzing: two complete runs of 40 minutes (seed 2: 16,354 mutated streams, 42 kept results; seed 3: 14,993 streams, 53 results), after a shorter first run that a WSL restart cut off (13 results). Every kept result was then replayed 3 times through each transducer, comparing the proxy's own view of what it forwarded with simoom's reading (tools/simoom_recheck.py): 709 forwarded streams (321 and 388), 0 flagged. Results that involve simoom, triaged by hand:
  • simoom stricter (simoom refuses or closes, another origin accepts): bare LF in the head or in chunked framing, whitespace or a high byte in Host, Host with a bad port, a duplicate Transfer-Encoding: chunked, Content-Length with Transfer-Encoding, a non-ASCII byte in the target, Connection: close plus keep-alive with a body and no length. Benign: simoom answers 400 and closes, so a proxy's next request goes on a new connection.
  • simoom accepts with the same boundaries but a different header set (13 in run 2, 20 in run 3): apache, gunicorn and nginx drop or rewrite headers with _ or odd names (CGI environments), nginx adds empty content-length/content-type, apache's CGI echo loses chunked bodies split across reads. Every one of these is a difference between the other origins and simoom's reading, which matches the majority. Benign.
  • Stream discrepancies after a transducer (run 3: a payload split into pieces, sent through apache_httpd_proxy or nginx_proxy): another origin returned nothing within the Garden's 50 ms origin timeout while simoom answered, or the proxy forwarded nothing on a retry. None reproduced in the replay above. Timing, benign.
  • Garbage first lines (os t: whatever) get GOAWAY instead of 400 because of bug 16; the Garden counts that as no response, which it treats as agreeing with a rejection. Benign.
  • No result where simoom read a different number of requests, a different body, or a different method or target than a proxy forwarded.
• Curated smuggling vectors (tools/simoom_curated.py, 39 streams: CL.TE, TE.CL, TE obfuscations, duplicate or listed Content-Length, chunk-size overflow and 0x, chunk extensions with LF or quoted CRLF, trailers that smuggle Content-Length, bare CR and LF, NUL, HTTP/1.0 with TE, GET with a body, Expect, CONNECT, Upgrade: h2c with a body, absolute-form, pipelining). Each was sent through haproxy, nginx_proxy, apache_httpd_proxy and h2o_proxy, and the proxy's own view of what it forwarded was compared with simoom's reading of the forwarded bytes: 0 of 156 proxy paths flagged. simoom refused 28 of the 39 directly.

QUIC Interop Runner

crates/simoom/examples/interop_server.rs follows the runner's endpoint contract: TESTCASE selects the case (unknown cases exit 127), files come from /www, the key and chain from /certs/priv.key and /certs/cert.pem, port 443 on [::] (IPv4 and IPv6). http3 goes through the simoom facade (Server::listen_quic, the production HTTP/3 path); every other case speaks hq-interop over a simoom_quic::Endpoint on a std UDP socket. The image builds it on the runner's endpoint image (martenseemann/quic-network-simulator-endpoint@sha256:3b2b9e6f…71a). Clients, pinned by digest: ngtcp2 ghcr.io/ngtcp2/ngtcp2-interop@sha256:4333a236…37e0, quiche cloudflare/quiche-qns@sha256:d8480e44…3f63df, quic-go martenseemann/quic-go-interop@sha256:fc8fc56c…4ea4e; simulator martenseemann/quic-network-simulator@sha256:c23d82a5…b6c9. The runner itself ran in a container with Python 3.12.12 and tshark 4.6.9, one runner call per case, a case retried only when tshark crashed.

Final full run (on the final tree, after bugs 17 to 21; ✓ passed, ✕ failed, – the client doesn't support the case or the server exits 127):

Totals: 54 of the 58 supported pairs pass. The 4 failures are zerortt against every client (0-RTT is refused by design, so the client's 0-RTT data is never accepted) and ecn against ngtcp2 (not implemented). The runner crashed in tshark on a few cases (it reads its pcaps through pyshark); those were run again and passed.

How it got there (earlier full runs on the same day):

• The first run had blackhole failing (bug 17: the send buffer stuck after a blackout), rebind-port and rebind-addr failing against quic-go (bug 18: no PATH_CHALLENGE in the first packet on the new path) and v2 failing against ngtcp2 (bug 19).
• quiche multiplexing failed with "Too many open files" in the quiche client: it keeps one file open per request and Docker Desktop's default soft limit is 1024 descriptors. An environment limit, not a simoom bug: the runner's compose file now gives the endpoints a nofile limit of 65536, and it passes 3 out of 3.
• handshakeloss and handshakecorruption failed now and then (quic-go: "handshake did not complete in time"; quiche: one of the 50 connections timed out). The traces showed the server resending a lost flight only on its own PTO, which heavy handshake loss had stretched to seconds. Bug 20 resends it as soon as the client's ClientHello comes again.
• blackhole against quic-go once ran past the runner's time limit before bug 20 and the final image; it passes in the final run and in the reruns below.

Reruns of the cases that had been intermittent, on the final image, 3 times each: quic-go handshakeloss 3/3, quic-go handshakecorruption 3/3, quic-go blackhole 3/3, quiche handshakeloss 3/3; quiche multiplexing 3/3 with the raised descriptor limit; ngtcp2 handshakeloss 3/3 (on the image before bug 21).

Bugs found and fixed in this pass

Smuggling divergences reviewed and judged benign:

• Requests simoom refuses but nginx or haproxy accept (41 streams). Each is a refusal on a stricter rule: bare LF, obs-fold, a Transfer-Encoding list, HTTP/1.0 with Transfer-Encoding, a high byte in a field, a lowercase method, and so on. Behind a proxy that forwards such a request, simoom answers 400 and closes. The proxy then sends the next request on a new connection, so the boundaries still agree.
• BWS before a chunk extension (5 ;ext). It is valid per RFC 9112 §7.1.1, and all three accept it the same way.
• Upgrade: h2c with a body. simoom serves it as HTTP/1.1, the same as the proxies.
• OPTIONS * and absolute-form. simoom accepts these, as RFC 9112 requires. haproxy refuses absolute-form whose authority differs from Host. That is its own policy, and safe either way since bug 2 was fixed.
• 0.CL with Expect: 100-continue. All three treat the body as a body: one request each.

Known gaps

• QUIC: no ECN (packets are not marked ECT and ACK frames carry no ECN counts: interop ecn fails), no preferred address and so no server-side active migration (connectionmigration unsupported), and 0-RTT is refused by design (zerortt fails). Handshake-space RTT samples can't be corrected by the peer's ACK delay (RFC 9002 §5.3), so heavy handshake loss inflates the RTT estimate and the PTO; bug 20 resends the flight when the client's ClientHello comes again, but a lost server flight with a client that probes only with PING still waits for the server's PTO.
• No external audit yet (plan §7.5). No Miri, ASan or TSan runs were part of this pass.
• HTTP/2 over TLS has not been run through h2spec (h2spec offers only TLS 1.2); the in-repo h2spec list (h2_live.rs) covers it.
• HTTP Garden ran only its HTTP/1.1 paths against simoom; its HTTP/2 fan-out (h2fanout) was not run.
• TLS groups are X25519 and P-256 only (no P-384, no ML-KEM hybrid), and there is no TLS 1.2. Clients that offer only those get handshake_failure, by design.
• Compatible version negotiation (RFC 9368) covers v1 and v2 only. After a switch to v2 the server keeps processing the client's v1 Initial packets until the Initial keys are discarded (fixed 2026-11-09, BUGS.md item 21).
• The coverage-guided fuzzer runs on Linux only, covers only the HTTP/1 target, and has no corpus minimisation.

Reproducing

# hermetic: everything above that runs in cargo test
cargo test --workspace --features simoom/full

# live HTTP/2 conformance against a running server
cargo run --release -p simoom --features full --example conformance_server -- \
    --addr 127.0.0.1:18080 --tls-addr 127.0.0.1:18443 --out /tmp/cs
SIMOOM_H2_LIVE_H2C=127.0.0.1:18080 SIMOOM_H2_LIVE_H2=127.0.0.1:18443 SIMOOM_H2_LIVE_CA=/tmp/cs/ca.pem \
    cargo test --release -p simoom --features full --test h2_live -- --ignored --nocapture

# request smuggling differential (WSL / Linux; nginx and haproxy from the Ubuntu archive)
python3 scripts/desync/desync.py --server target/release/examples/conformance_server \
    --nginx /usr/sbin/nginx --haproxy /usr/sbin/haproxy

# long fuzzing, per harness
SIMOOM_FUZZ_ITERS=20000000 SIMOOM_FUZZ_SEED=7 cargo test --release -p simoom-h2 --test fuzz

# third-party suites (WSL, outside the repository; versions in the table above)
h2spec -h 127.0.0.1 -p 18080 -o 3                    # against conformance_server --addr
conformance_server --garden --addr 0.0.0.0:80        # the HTTP Garden origin (in its Docker image)
TESTCASE=transfer interop_server --addr [::]:443 --www /www --certs /certs   # QUIC Interop Runner endpoint
python3 run.py -s simoom -c ngtcp2,quiche,quic-go    # in the runner checkout, simoom added to implementations_quic.json

Notes for the QUIC Interop Runner on Docker 28 or later: the runner's two bridge networks need com.docker.network.bridge.gateway_mode_ipv4: nat-unprotected (and _ipv6), otherwise Docker's direct-routing protection (raw-table PREROUTING drops) discards the bridged frames between the client and the simulator and every test fails, the runner's reference pairs included. The runner needs Python 3.12 (pyshark fails on 3.14) and tshark 4.5 or later.