AIKIDO-2026-168095

TL;DR

The optimised C HTTP response parser builds an error-message snippet for a malformed response by reading from the fed buffer using the raw llhttp error-position pointer. When the response is malformed in specific ways this read can extend past the end of the allocated buffer, producing an out-of-bounds heap read. An attacker-controlled or compromised server, or an accidental malformed response, can crash the client and cause a denial of service. The fix slices the error snippet from a bounded buffer using a computed offset so the read stays within the allocated bytes.