Penzzer
Twenty-Six Defects in HTTP, and None of Them in the Parser
We tested seven HTTP implementations and uncovered 26 defects. Two came back clean, and both of them were the request parser. Everything that broke was the code around it: the limits, the framing, the buffers and the state that outlived the request.













