Download Latest Version vulcain-legacy_Windows_i386.zip (4.3 MB)
Email in envelope

Get an email when there's a new version of Vulcain

Home / v1.4.2
Name Modified Size InfoDownloads / Week
Parent folder
checksums.txt 2026-07-18 1.9 kB
0
vulcain-legacy_Windows_x86_64.zip 2026-07-18 4.5 MB
0
vulcain_Linux_armv6.tar.gz 2026-07-18 31.3 MB
0
vulcain-legacy_Darwin_arm64.tar.gz 2026-07-18 4.1 MB
0
vulcain-legacy_Darwin_x86_64.tar.gz 2026-07-18 4.4 MB
0
vulcain-legacy_Linux_x86_64.tar.gz 2026-07-18 4.4 MB
0
vulcain-legacy_Windows_i386.zip 2026-07-18 4.3 MB
1 1 weekly downloads
vulcain-legacy_Linux_arm64.tar.gz 2026-07-18 4.0 MB
0
vulcain-legacy_Windows_arm64.zip 2026-07-18 4.0 MB
0
vulcain-legacy_Linux_armv6.tar.gz 2026-07-18 4.2 MB
0
vulcain-legacy_Linux_i386.tar.gz 2026-07-18 4.2 MB
0
vulcain_Linux_armv5.tar.gz 2026-07-18 31.2 MB
0
vulcain_Windows_arm64.zip 2026-07-18 30.8 MB
0
vulcain_Darwin_arm64.tar.gz 2026-07-18 32.9 MB
0
vulcain_Linux_arm64.tar.gz 2026-07-18 30.8 MB
0
vulcain_Windows_i386.zip 2026-07-18 32.5 MB
0
vulcain_Windows_x86_64.zip 2026-07-18 33.6 MB
0
vulcain_Darwin_x86_64.tar.gz 2026-07-18 34.8 MB
0
vulcain_Linux_armv7.tar.gz 2026-07-18 31.2 MB
0
vulcain_Linux_i386.tar.gz 2026-07-18 32.0 MB
0
vulcain_Linux_x86_64.tar.gz 2026-07-18 33.3 MB
0
README.md 2026-07-18 1.2 kB
0
v1.4.2 source code.tar.gz 2026-07-18 1.9 MB
0
v1.4.2 source code.zip 2026-07-18 1.9 MB
0
Totals: 24 Items   396.3 MB 1

Security release fixing three vulnerabilities in request-directive handling, all reported by Alexandre Daubois (Les-Tilleuls.coop). Users on 1.4.1 and earlier should upgrade.

đź”’ Security Fixes

  • High (GHSA-qwqr-3x94-53xc): Fix quadratic (O(N²)) response rebuild on wildcard Preload/Fields match against large arrays, which enabled a low-bandwidth algorithmic-complexity denial of service. Rebuild is now a single O(N) pass. by @dunglas
  • Medium (GHSA-7825-cqgv-jjqr): Bound JSON-pointer recursion depth, preventing ~100Ă— memory amplification from directives with many /-delimited segments. partsToTree is now iterative. by @dunglas
  • Low (GHSA-gqmm-v8j2-px6g): Close a TOCTOU data race on the shared push counter that let concurrent HTTP/2 pushes marginally exceed maxPushes. Counter check now holds the mutex. by @dunglas

Full Changelog: https://github.com/dunglas/vulcain/compare/v1.4.1...v1.4.2

Source: README.md, updated 2026-07-18