project

cohttp

OCaml library providing HTTP client and server implementations, used as the HTTP layer by many OCaml web services.

Known aliases

ocaml-cohttp

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

Probes hit a maintainer's webserver ten minutes after his fix PR went public

Anil Madhavapeddy's account of the cohttp 6.3.0 path traversal fix puts a number on the gap between publishing a patch and being probed for the bug it closes. The three alternatives he examined each cost a small maintainer something.

Publishers:tldrsec.com

Reality

Evidence42
Adoption18
Hype gap+32
Incentives40
Confidence45

build1 publisher

Opening the cohttp fix PR drew traversal probes within ten minutes

Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.

Publishers:anil.recoil.org

Reality

Evidence52
Adoption44
Hype gap+14
Incentives55
Confidence57