chunkloris: hypercorn
on this page
part of the chunkloris per-chunk amplification survey. this page is the per-server record for hypercorn under http/1.1 chunked transfer encoding.
at a glance
- server: hypercorn
0.17.3 - runtime: python-3.12
- ecosystem: python
- concurrency model: event-loop
- parser: h11 0.16.0
- delivery granularity:
per-chunk - chunk-limit helper: none exposed by the framework
- verdict: per-chunk — the parser/dispatcher boundary delivers one event per wire chunk. cpu cost under paced mode b is measurable per chunk.
- scaling exponent (mode a): 0.98 (wall time vs N, log-log slope across common cells)
- scaling exponent (mode b): 1.00
measurements
all cells run on a 1-vcpu docker container. cpu cost is derived from the target container’s cgroup v2 cpu.stat usage_usec delta around each cell.
| mode | N | wall (s) | server cpu % | µs / chunk | basis | ok |
|---|---|---|---|---|---|---|
A-bridge-coalesced | 50,000 | 0.280 | 111.8 | 6.265 | server-cpu-cgroup | ✓ |
A-bridge-coalesced | 100,000 | 0.538 | 107.6 | 5.787 | server-cpu-cgroup | ✓ |
A-bridge-coalesced | 250,000 | 1.344 | 101.6 | 5.461 | server-cpu-cgroup | ✓ |
A-bridge-coalesced | 500,000 | 3.870 | — | 7.740 | wall | ✓ |
A-bridge-coalesced | 1,000,000 | 7.560 | — | 7.560 | wall | ✓ |
B-paced-100us | 50,000 | 5.124 | 23.0 | 23.585 | server-cpu-cgroup | ✓ |
B-paced-100us | 100,000 | 10.248 | 23.0 | 23.585 | server-cpu-cgroup | ✓ |
B-paced-100us | 250,000 | 25.597 | 22.9 | 23.461 | server-cpu-cgroup | ✓ |
what this means
the parser/dispatcher path on this server delivers one event per chunked-transfer-encoding chunk, so an attacker who sends a body as N one-byte chunks consumes roughly N × (mode-b µs/chunk) of server cpu on a single core. amplification scales linearly with N until the framework’s max_request_body_size (or equivalent) is hit.
what to do today
- if this server runs as an origin behind nginx with the default
proxy_request_buffering on, the per-chunk attack shape does not reach this server — nginx delivers one content-length-framed body to the upstream in a singlerecv(). - if deployed direct-exposed, behind haproxy with default streaming, or behind any reverse proxy with
proxy_request_buffering off, the per-chunk cost reaches this server. - there is no framework-level chunk-count limit in the default config; use a frontend buffer, transport-layer rate limiting, or a wrapping middleware that imposes a chunk-count cap before draining the body.
reproducer
the full reproducer for this server is in the paper repo. the docker container pins hypercorn 0.17.3 and constrains the test container to a single cpu (--cpus=1). the prober script implements mode a (bridge-coalesced) and mode b (paced 100 µs) per the methodology section.
see the draft pdf for the full per-framework discussion.