fix(security): 1.35.6 hardening stack (14-vector audit remediation)#85

Draft

andypost wants to merge 13 commits into

freeunitorg:pre-1.35.6from

andypost:hardening-1.35.6

Commits on Jun 11, 2026

fix(tls): validate cert/key pair and guard wildcard SAN matcher

andypost
and
claude
committed
fix(routing): correct CIDR, regex, and port-range matcher edges

andypost
and
claude
committed
fix(fd): tighten FD/CLOEXEC lifetime across accept/pipe/compression

andypost
and
claude
committed
fix(websocket): tighten frame-bound checks in libunit and protocol

andypost
and
claude
committed
fix(port): bounds-check untrusted shmem offsets in port and libunit

andypost
and
claude
committed
fix(sapi): bounds-check app-supplied arguments in language bindings

andypost
and
claude
committed
fix(isolation): tighten control-socket, mount, and cgroup boundaries

andypost
and
claude
committed
fix(controller): cap JSON parser limits and harden request state

andypost
and
claude
committed
fix(http): bound proxy Content-Length and URI/string helpers

andypost
and
claude
committed
docs(changes): record 1.35.6 hardening fixes

andypost
and
claude
committed

Commits on Jun 22, 2026