Developer fixes memory and goroutine leaks in open-source Nuclei vulnerability scanner
A developer identified and resolved persistent memory and goroutine leaks in ProjectDiscovery's Nuclei vulnerability scanner engine, documented in Issue #7503 and Pull Request #7508 on GitHub. The leaks surfaced when Nuclei was embedded as an SDK inside long-running microservices, where memory usage grew steadily and orphaned goroutines persisted even after the engine was closed. Three root causes were found: an unbounded sync.Map storing host-port mappings, unreleased per-host rate limiter goroutines, and cached template parsers that were never purged between engine instances. Fixes included replacing the unbounded map with a capacity-capped, expirable LRU cache, updating the protocol state teardown to release rate limiter workers, and adding a thread-safe cache purge method invoked during engine shutdown.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in