From 0a8d64bb2fed9a5a79b6c49b91c1efeff4cb19d6 Mon Sep 17 00:00:00 2001
From: Meghan Denny <hello@nektro.net>
Date: Sun, 10 May 2026 19:30:45 -0700
Subject: [PATCH] cap Server.receiveHead at 128 request headers, could be a dos
 attempt otherwise

---
 http.zig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/http.zig b/http.zig
index 1f919c0a3ed57fa8904ffcc3898c13475d429062..efa4d96fc40a10c9b9d7cec085b73e7b89400710 100644
--- a/http.zig
+++ b/http.zig
@@ -421,6 +421,7 @@ pub const Server = struct {
         while (true) {
             const line = try server.reader.readUntilDelimitersBuf(&scratch_buffer, "\r\n");
             if (line.len == 0) break;
+            if (headers.count() == 128) return error.InvalidRequest;
             const name_end = std.mem.indexOfScalar(u8, line, ':') orelse return error.InvalidRequest;
             const name = line[0..name_end];
             for (name) |*c| {
-- 
2.54.0