Summary

Security fixes identified during review of the request-body-streaming refactor:

• CWE-444 HTTP Request Smuggling (RequestTemplate.java): Restored the defensive Content-Length header clear before conditionally setting it. The streaming refactor had accidentally removed the header(CONTENT_LENGTH, Collections.emptyList()) reset, allowing duplicate or stale Content-Length values when body() is called more than once or when a prior header already existed.
• CWE-134 Format-String Injection (Logger.java): The body-logging call was changed from log(configKey, "%s", body.toString()) to log(configKey, body.toString()), making raw request body the printf format string. Any % in the body (e.g. JSON {"discount":"50%"}) throws an unchecked IllegalFormatException propagating out of logRequest. Fixed by restoring "%s" as the format argument.
• ForkJoinPool starvation / DoS (AsyncApacheHttp5Client.java, Http2Client.java): Both async clients defaulted to ForkJoinPool.commonPool() as the executor for the blocking body-write bridge. This pins one JVM-wide common-pool thread per in-flight request, defeating the async model and enabling DoS via pool starvation. Replaced with a dedicated daemon-thread newCachedThreadPool().

Test plan

• mvn test passes (778 tests — core: 601, hc5: 102, java11: 75, 0 failures)
• Integration tests via mvn clean install -Pdev
• Verify no regression in HTTP/1.1 and HTTP/2 clients under concurrent load

🤖 Generated with Claude Code