9 posts
OxiHTTP 0.2.1 is a security-hardening release for the COOLJAPAN Pure-Rust HTTP stack: it closes a redirect credential leak, two WebSocket unbounded-memory DoS paths, a chunked-encoding body-limit bypass, a spoofable rate-limiter key, a client decompression bomb, and more — 320 tests passing (446 with all features), the sovereign HTTP layer for the COOLJAPAN ecosystem.
OxiRPC 0.2.1 adds a 100% Pure-Rust HTTP/3 (gRPC-over-QUIC) transport behind the opt-in http3 feature, closes a bug where a missing grpc-status trailer could look like a successful empty stream, adds a frame-size overflow guard, and validates gRPC Content-Type on every native transport path — 702 tests passing (801 with all features), the sovereign gRPC layer for the COOLJAPAN ecosystem.
OxiQUIC 0.2.1 closes five RFC 9000 security gaps — spoofed-source reflection amplification, unbounded per-stream and CRYPTO-buffer memory growth, and a forgeable Retry handshake — adds bidirectional ECN (RFC 9000 §13.4 / RFC 9002 §7.4) and true per-path congestion control for multipath, and ships runnable QUIC/HTTP-3 examples. 445 tests passing, the sovereign Pure Rust QUIC layer for the COOLJAPAN ecosystem.
OxiTLS 0.3.0 fixes an OCSP staple false-rejection on leaf-only certificate chains, converts an HPKE LabeledExpand panic into a propagated Result, and adds three new fuzz targets covering its own hand-rolled TLS parsers — 364 tests passing, the sovereign Pure Rust TLS layer for the COOLJAPAN ecosystem.
OxiTLS 0.2.1 eliminates RUSTSEC-2026-0104 by forking its Pure-Rust CryptoProvider into a webpki-free oxitls-rustcrypto-provider crate, closes an OCSP staple replay bypass, and fixes SCT parsing — 443 tests passing, the sovereign Pure Rust TLS layer for the COOLJAPAN ecosystem.
OxiHTTP is the COOLJAPAN Pure-Rust HTTP stack: an async client and server for HTTP/1.1, HTTP/2, and HTTP/3 with no curl, no OpenSSL, and no -sys crates. Transport security comes from OxiTLS. A reqwest/hyper-free facade and part of the NoFFI sovereign Rust stack.
OxiRPC is the COOLJAPAN Pure-Rust gRPC stack: tonic-style gRPC over HTTP/2 whose proto codegen, TLS, and compression are 100% Pure Rust. No protoc binary, no OpenSSL, no ring by default — codegen via OxiProto, TLS via OxiTLS, gzip/zstd via OxiARC. Part of the NoFFI sovereign Rust stack.
OxiQUIC is the COOLJAPAN Pure Rust QUIC transport and HTTP/3 stack. It implements RFC 9000/9001/9002 directly on the rustls QUIC TLS 1.3 API, driven by a Pure Rust crypto provider over tokio UDP — with zero dependency on ring, aws-lc-rs, or any C/C++ cryptographic library. Part of the NoFFI sovereign Rust stack.
OxiTLS is the COOLJAPAN Pure Rust TLS transport stack — a NoFFI replacement for OpenSSL, native-tls, and the ring / aws-lc-rs C-and-assembly crypto backends. TLS 1.3 and 1.2, mTLS, ALPN, session resumption, OCSP stapling, post-quantum key exchange, and a Pure-Rust CryptoProvider by default. The transport-security foundation under OxiHTTP, OxiQUIC, and OxiRPC.