{
  "schemaVersion": 1,
  "caseId": "gorilla-websocket-cve-2020-27813",
  "run": "historical-detection-20261020",
  "preregistration": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/preregistration.json",
    "sha256": "6c7ef71cffa3729de787444c67823b01afcda71d61b42f2a005fda892a07db91",
    "websiteCommit": "aeb254a5673d716048f72d500fc57aaca477042c"
  },
  "tool": {
    "name": "vettalon",
    "version": "0.3.0"
  },
  "models": {
    "finder": "claude-opus-5-5 via claude CLI 2.1.300 (Anthropic)",
    "verifiers": [
      "grok-4.7 via grok CLI 1.0.62 (xAI, container sandbox)",
      "gpt-oss-120b-medium via agy 1.4.3 (OpenAI family, host)"
    ]
  },
  "command": "vettalon scan <release tree> --profile deep --config roster.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --source-receipts --trace trace.jsonl --report report.json --fail-on none --lang en",
  "hintLevel": "L0",
  "target": {
    "file": "conn.go",
    "vulnerableRanges": [
      [
        792,
        870
      ],
      [
        989,
        995
      ]
    ],
    "fixedRanges": [
      [
        803,
        899
      ],
      [
        1022,
        1030
      ]
    ],
    "acceptedCwes": [
      "CWE-190",
      "CWE-191",
      "CWE-400",
      "CWE-770",
      "CWE-789",
      "CWE-680"
    ]
  },
  "arms": {
    "vulnerable": {
      "version": "v1.4.0",
      "archiveUrl": "https://proxy.golang.org/github.com/gorilla/websocket/@v/v1.4.0.zip",
      "archiveSha256": "937dac399bca2f88344c31ee295cd57310244bc1a3a58e8bcb14ab26a6009d0e",
      "treeSha256": "572dcbee4d7423a4e3b2588e5dc9d68a82f0fdd9c6d2738c3446adb05a5b82da",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "units_failed",
      "calls": {
        "total": 11,
        "finder": 9,
        "verifier": 2,
        "failed": 1
      },
      "reportSha256": "a75bb0c859555fe2e77114a6ac9278b41d96643fe736b01b36cce6b57869a421",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "10b4227cf1d509125ef50d20c390f742e12873c9a18c4a3afcc2ec2b508fa6d1"
      },
      "outcome": "found",
      "matches": [
        {
          "file": "conn.go",
          "line": 843,
          "cwe": "CWE-190",
          "severity": "high",
          "status": "candidate",
          "title": "Signed overflow of 64-bit frame length bypasses SetReadLimit, allowing unbounded memory consumption",
          "verification": [
            {
              "model": "grok",
              "family": "xai",
              "verdict": "no_verdict"
            }
          ]
        }
      ],
      "otherFindings": {
        "total": 1,
        "byStatus": {
          "candidate": 1
        },
        "reviewed": false
      }
    },
    "fixed": {
      "version": "v1.4.1",
      "archiveUrl": "https://proxy.golang.org/github.com/gorilla/websocket/@v/v1.4.1.zip",
      "archiveSha256": "86eb427567de9e2dc84da52ee4f4315496c5ffc2152928df0e3ac4ce8a359ff7",
      "treeSha256": "05f13b6075dc41fdcfc29d72557b4d32fa2f30aa0c56dfeb46648301d5421554",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "scope_not_fully_reviewed",
      "calls": {
        "total": 12,
        "finder": 10,
        "verifier": 2,
        "failed": 0
      },
      "reportSha256": "88df77164fb53043be53795230a0c55372e64980d0e4a23107a078c1c753c102",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "e4ec8036702c53151b2f4efb4f587009be2d9f7651e94df27f2e2c0418eeab2d"
      },
      "outcome": "notFlagged",
      "matches": [],
      "otherFindings": {
        "total": 2,
        "byStatus": {
          "needs_human": 1,
          "refuted": 1
        },
        "reviewed": false
      }
    }
  },
  "limitations": {
    "zh": "這是已公開、已修補漏洞的偵測基準，不是新發現。模型訓練資料可能已包含此公告或修補，命中不能證明模型是從程式碼推理出來的。候選與 needs_human 都不是自動確認，也沒有執行 PoC。比對標準在掃描前登錄；其他輸出只列數量，未經審閱、未公開位置。原始 report.json 與 trace 不公開，只列 SHA-256。單次執行，模型輸出有隨機性，重跑結果可能不同。",
    "en": "This is a detection benchmark on an already disclosed and patched issue, not a new discovery. The models may have seen the advisory or the fix during training, so a match does not show that the model reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC was run. Match criteria were registered before scanning. Other findings are listed as counts only; they were not reviewed and their locations are not published. The raw report.json and trace are not public; only their SHA-256 is listed. Single run; model output is nondeterministic and a rerun may differ."
  }
}