Skip to content

Fix ASM accessing HttpRequest.Headers on .NET Framework without guarding#8611

Merged
andrewlock merged 2 commits into
masterfrom
andrew/fix-asm-request-headers
May 19, 2026
Merged

Fix ASM accessing HttpRequest.Headers on .NET Framework without guarding#8611
andrewlock merged 2 commits into
masterfrom
andrew/fix-asm-request-headers

Conversation

@andrewlock

@andrewlock andrewlock commented May 12, 2026

Copy link
Copy Markdown
Member

Summary of changes

  • Remove need for allocating a closure
  • Fix potential HttpRequestValidationException leaking in ASM paths

Reason for change

Calling HttpRequest.Headers can throw an HttpRequestValidationException if the headers contain "dangerous values". We guarded against that in #5943 by adding a helper, but in #6164 we refactored, and stopped using it.

Implementation details

  • Reinstates using RequestDataHelper.GetHeaders() instead of calling request.Headers directly.
  • Removes the need for a closure allocation every time you call SecurityCoordinator.ExtractHeaders() by allowing you to pass the collection in to the method, and passing that through to the Func. Not required, just a minor perf optimization

Test coverage

Meh - correctness should be covered by existing tests. Adding a regression test seems overkill tbh

@andrewlock
andrewlock requested a review from a team as a code owner May 12, 2026 12:48
NachoEchevarria
NachoEchevarria approved these changes May 12, 2026
View reviewed changes

@NachoEchevarria NachoEchevarria left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@pr-commenter

pr-commenter Bot commented May 12, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-05-12 13:41:32

Comparing candidate commit 279738a in PR branch andrew/fix-asm-request-headers with baseline commit 4b9ebf8 in branch master.

Some scenarios are present only in baseline or only in candidate runs. If you didn't create or remove some scenarios in your branch, this maybe a sign of crashed benchmarks 💥💥💥
Check Gitlab CI job log to find if any benchmark has crashed.

Scenarios present only in baseline:

  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan net472
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net472
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net6.0
  • Benchmarks.OpenTelemetry.Api.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net6.0

Found 1 performance improvements and 2 performance regressions! Performance is the same for 48 metrics, 21 unstable metrics, 87 known flaky benchmarks, 39 flaky benchmarks without significant changes.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TracerBenchmark.StartRootSpan net6.0

  • 🟥 allocated_mem [+143 bytes; +144 bytes] or [+10.108%; +10.117%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TracerBenchmark.StartSpan net6.0

  • 🟩 allocated_mem [-144 bytes; -143 bytes] or [-9.188%; -9.180%]

scenario:Benchmarks.Trace.HttpClientBenchmark.SendAsync net6.0

  • 🟥 throughput [-81143.548op/s; -72906.935op/s] or [-55.122%; -49.527%]

Known flaky benchmarks

These benchmarks are marked as flaky and will not trigger a failure. Modify FLAKY_BENCHMARKS_REGEX to control which benchmarks are marked as flaky.

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan net6.0

  • unstable execution_time [+15.379ms; +51.382ms] or [+11.033%; +36.862%]
  • unstable throughput [-66938.173op/s; -27098.894op/s] or [-33.697%; -13.642%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan netcoreapp3.1

  • unstable execution_time [-13.644ms; +20.890ms] or [-12.218%; +18.707%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net6.0

  • unstable execution_time [-8.152ms; +27.367ms] or [-5.656%; +18.988%]
  • unstable throughput [-14535.536op/s; +9036.817op/s] or [-9.782%; +6.081%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1

  • unstable execution_time [+2.186ms; +41.551ms] or [+1.936%; +36.798%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net6.0

  • unstable execution_time [-26.099ms; -9.713ms] or [-18.399%; -6.848%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1

  • unstable execution_time [+0.490ms; +39.382ms] or [+0.433%; +34.830%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net6.0

  • unstable execution_time [-59.483ms; -20.214ms] or [-31.567%; -10.727%]
  • unstable throughput [+6506.771op/s; +27922.877op/s] or [+5.750%; +24.677%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1

  • unstable execution_time [+8.215ms; +32.958ms] or [+8.874%; +35.601%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1

  • unstable execution_time [-14.496ms; +20.158ms] or [-13.105%; +18.223%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net6.0

  • unstable execution_time [-30.085ms; -11.772ms] or [-20.980%; -8.209%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1

  • unstable execution_time [+11.735ms; +35.965ms] or [+13.170%; +40.361%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan net6.0

  • unstable execution_time [-24147.487µs; +24211.359µs] or [-14.178%; +14.215%]
  • unstable throughput [-15105.161op/s; +17523.226op/s] or [-10.337%; +11.992%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan netcoreapp3.1

  • unstable execution_time [-39.459ms; -15.425ms] or [-33.840%; -13.228%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net6.0

  • 🟥 allocated_mem [+95 bytes; +96 bytes] or [+5.401%; +5.408%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net6.0

  • 🟩 allocated_mem [-144 bytes; -143 bytes] or [-9.188%; -9.180%]
  • unstable execution_time [-14.875ms; +8.377ms] or [-10.568%; +5.952%]
  • unstable throughput [-34636.060op/s; -1254.602op/s] or [-19.628%; -0.711%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled netcoreapp3.1

  • unstable execution_time [+30.786ms; +60.769ms] or [+34.721%; +68.535%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net6.0

  • 🟩 allocated_mem [-144 bytes; -143 bytes] or [-5.210%; -5.202%]
  • unstable execution_time [-36.193ms; -7.363ms] or [-24.359%; -4.956%]
  • unstable throughput [+11704.959op/s; +33858.420op/s] or [+11.875%; +34.350%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled netcoreapp3.1

  • unstable execution_time [+10.834ms; +36.283ms] or [+12.637%; +42.324%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net6.0

  • unstable execution_time [+24.284ms; +50.046ms] or [+17.092%; +35.225%]
  • unstable throughput [-21138.393op/s; -8233.456op/s] or [-16.624%; -6.475%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled netcoreapp3.1

  • unstable execution_time [+29.155ms; +58.980ms] or [+32.404%; +65.553%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net6.0

  • unstable execution_time [-17.465ms; -0.772ms] or [-12.204%; -0.540%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net6.0

  • unstable execution_time [-14.340ms; +10.169ms] or [-10.090%; +7.155%]
  • unstable throughput [-10128.804op/s; +10216.757op/s] or [-6.247%; +6.301%]

scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled netcoreapp3.1

  • unstable execution_time [-18502.845µs; +16680.381µs] or [-16.520%; +14.893%]

scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net6.0

  • unstable execution_time [-27.710ms; -4.518ms] or [-13.825%; -2.254%]
  • 🟥 throughput [-62554.128op/s; -51343.200op/s] or [-52.579%; -43.156%]

scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild netcoreapp3.1

  • unstable execution_time [-29.571ms; -6.604ms] or [-14.873%; -3.321%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net472

  • 🟥 execution_time [+305.657ms; +319.623ms] or [+151.678%; +158.608%]
  • 🟥 throughput [-63.122op/s; -50.608op/s] or [-11.357%; -9.105%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • 🟥 execution_time [+99.179ms; +101.031ms] or [+78.357%; +79.820%]
  • 🟩 throughput [+85.360op/s; +92.112op/s] or [+11.254%; +12.145%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

  • 🟥 execution_time [+84.614ms; +85.873ms] or [+74.880%; +75.995%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net472

  • 🟥 allocated_mem [+1.308KB; +1.308KB] or [+27.528%; +27.540%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net6.0

  • 🟥 allocated_mem [+439 bytes; +440 bytes] or [+9.299%; +9.310%]
  • 🟩 execution_time [-54.100ms; -34.464ms] or [-25.266%; -16.096%]
  • unstable throughput [-29107.254op/s; -15192.075op/s] or [-21.247%; -11.089%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody netcoreapp3.1

  • 🟥 allocated_mem [+1.272KB; +1.272KB] or [+27.500%; +27.510%]
  • 🟩 execution_time [-33.396ms; -16.430ms] or [-15.903%; -7.824%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net472

  • 🟥 allocated_mem [+1.307KB; +1.307KB] or [+105.743%; +105.758%]
  • 🟥 throughput [-264724.187op/s; -256079.969op/s] or [-27.030%; -26.147%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net6.0

  • 🟥 allocated_mem [+439 bytes; +440 bytes] or [+35.945%; +35.954%]
  • unstable execution_time [-85.782ms; -53.904ms] or [-38.255%; -24.039%]
  • unstable throughput [-260649.228op/s; -134545.880op/s] or [-27.846%; -14.374%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody netcoreapp3.1

  • 🟥 allocated_mem [+1.272KB; +1.272KB] or [+105.288%; +105.304%]
  • unstable execution_time [-63.532ms; -38.450ms] or [-31.713%; -19.192%]
  • 🟥 throughput [-119716.881op/s; -103567.587op/s] or [-17.201%; -14.881%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net6.0

  • unstable execution_time [-41.017ms; -19.262ms] or [-20.695%; -9.719%]
  • unstable throughput [-23851.847op/s; -7091.634op/s] or [-15.177%; -4.512%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody netcoreapp3.1

  • unstable execution_time [-47.581ms; -27.580ms] or [-24.259%; -14.061%]
  • 🟩 throughput [+10081.384op/s; +12748.592op/s] or [+8.031%; +10.156%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net6.0

  • unstable execution_time [-55.751ms; -32.903ms] or [-27.565%; -16.268%]
  • unstable throughput [-333597.059op/s; +33267.843op/s] or [-11.124%; +1.109%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1

  • 🟩 execution_time [-98.408ms; -78.219ms] or [-45.363%; -36.056%]
  • 🟩 throughput [+175451.603op/s; +231339.050op/s] or [+6.964%; +9.182%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net472

  • 🟥 execution_time [+301.803ms; +316.877ms] or [+150.801%; +158.333%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net6.0

  • 🟥 execution_time [+132.706ms; +140.376ms] or [+66.924%; +70.792%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs netcoreapp3.1

  • 🟥 execution_time [+300.329ms; +306.903ms] or [+151.282%; +154.594%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net472

  • 🟥 execution_time [+298.090ms; +311.899ms] or [+146.410%; +153.192%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net6.0

  • 🟥 execution_time [+240.393ms; +257.625ms] or [+117.519%; +125.944%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1

  • 🟥 execution_time [+303.587ms; +309.660ms] or [+151.732%; +154.767%]

scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net6.0

  • 🟥 execution_time [+18.788µs; +42.377µs] or [+5.998%; +13.529%]
  • 🟥 throughput [-398.388op/s; -199.849op/s] or [-12.419%; -6.230%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net472

  • 🟥 execution_time [+300.663ms; +301.482ms] or [+150.062%; +150.470%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0

  • unstable execution_time [+318.371ms; +520.014ms] or [+345.923%; +565.016%]
  • 🟥 throughput [-7114.086op/s; -6704.186op/s] or [-58.457%; -55.089%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest netcoreapp3.1

  • unstable execution_time [+217.272ms; +274.892ms] or [+164.973%; +208.723%]
  • 🟥 throughput [-1371.024op/s; -1124.540op/s] or [-13.272%; -10.886%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

  • 🟥 execution_time [+302.800ms; +317.677ms] or [+139.225%; +146.065%]
  • 🟥 throughput [-686.647op/s; -669.777op/s] or [-62.217%; -60.688%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • unstable execution_time [-58.126ms; +75.374ms] or [-24.771%; +32.121%]
  • 🟥 throughput [-684.924op/s; -596.973op/s] or [-45.685%; -39.818%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

  • 🟥 allocated_mem [+2.305KB; +2.308KB] or [+5.442%; +5.450%]
  • 🟥 execution_time [+341.866ms; +351.608ms] or [+204.476%; +210.302%]
  • 🟥 throughput [-724.317op/s; -690.379op/s] or [-50.433%; -48.070%]

scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net472

  • 🟩 throughput [+26.466op/s; +28.594op/s] or [+5.259%; +5.682%]

scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0

  • 🟩 execution_time [-175.166µs; -161.964µs] or [-8.873%; -8.204%]
  • 🟩 throughput [+45.369op/s; +49.397op/s] or [+8.956%; +9.751%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net472

  • 🟥 execution_time [+304.171ms; +317.057ms] or [+153.175%; +159.664%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net6.0

  • unstable execution_time [+168.347ms; +214.264ms] or [+84.359%; +107.368%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch netcoreapp3.1

  • 🟥 execution_time [+302.494ms; +309.228ms] or [+151.960%; +155.343%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net472

  • 🟥 execution_time [+303.849ms; +316.835ms] or [+152.583%; +159.104%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net6.0

  • unstable execution_time [+264.940ms; +292.768ms] or [+131.001%; +144.761%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync netcoreapp3.1

  • 🟥 execution_time [+301.117ms; +308.305ms] or [+152.619%; +156.263%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net472

  • 🟥 execution_time [+302.374ms; +316.830ms] or [+151.765%; +159.020%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net6.0

  • unstable execution_time [+155.178ms; +233.305ms] or [+77.342%; +116.281%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync netcoreapp3.1

  • 🟥 execution_time [+300.568ms; +307.137ms] or [+149.530%; +152.798%]

scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net6.0

  • unstable execution_time [-54.474ms; -26.606ms] or [-25.331%; -12.372%]
  • unstable throughput [-159162.529op/s; -107513.858op/s] or [-43.663%; -29.494%]

scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog netcoreapp3.1

  • unstable execution_time [-71.355ms; -43.889ms] or [-35.792%; -22.015%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net6.0

  • 🟩 allocated_mem [-25.944KB; -25.920KB] or [-9.464%; -9.455%]
  • unstable execution_time [-79.388µs; -24.617µs] or [-15.691%; -4.865%]
  • 🟩 throughput [+121.678op/s; +320.829op/s] or [+6.072%; +16.010%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark netcoreapp3.1

  • 🟩 allocated_mem [-19.507KB; -19.490KB] or [-7.111%; -7.105%]
  • unstable execution_time [-79.932µs; -18.773µs] or [-13.852%; -3.253%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net6.0

  • 🟥 execution_time [+3.131µs; +7.360µs] or [+7.400%; +17.397%]
  • 🟥 throughput [-3501.759op/s; -1641.462op/s] or [-14.741%; -6.910%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark netcoreapp3.1

  • unstable execution_time [-12.658µs; -3.212µs] or [-19.639%; -4.983%]
  • unstable throughput [+983.876op/s; +2919.076op/s] or [+6.036%; +17.909%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net472

  • 🟥 execution_time [+306.461ms; +320.783ms] or [+154.903%; +162.141%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net6.0

  • unstable execution_time [+185.813ms; +602.823ms] or [+94.578%; +306.835%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog netcoreapp3.1

  • unstable execution_time [+266.690ms; +294.244ms] or [+133.511%; +147.305%]

scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net6.0

  • unstable execution_time [-82.530ms; -51.200ms] or [-41.252%; -25.592%]
  • unstable throughput [-159145.911op/s; -83184.180op/s] or [-30.123%; -15.745%]

scenario:Benchmarks.Trace.RedisBenchmark.SendReceive netcoreapp3.1

  • unstable execution_time [-29.959ms; -5.962ms] or [-15.186%; -3.022%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net472

  • 🟥 execution_time [+302.392ms; +317.228ms] or [+150.715%; +158.110%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net6.0

  • unstable execution_time [+253.890ms; +293.326ms] or [+127.492%; +147.295%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog netcoreapp3.1

  • 🟥 execution_time [+306.031ms; +312.568ms] or [+155.199%; +158.515%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net472

  • 🟥 execution_time [+300.748ms; +301.757ms] or [+150.015%; +150.518%]
  • 🟩 throughput [+64784733.712op/s; +65129300.409op/s] or [+47.180%; +47.431%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net6.0

  • unstable execution_time [+364.107ms; +375.085ms] or [+452.832%; +466.485%]
  • 🟥 throughput [-7434.541op/s; -7224.119op/s] or [-57.473%; -55.846%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore netcoreapp3.1

  • 🟥 execution_time [+301.099ms; +302.566ms] or [+150.181%; +150.913%]
  • 🟥 throughput [-29618629.523op/s; -28548511.781op/s] or [-13.119%; -12.645%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net6.0

  • unstable execution_time [-76.631ms; -49.739ms] or [-37.533%; -24.361%]
  • unstable throughput [-212834.999op/s; -59304.704op/s] or [-19.872%; -5.537%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope netcoreapp3.1

  • unstable execution_time [-86.078ms; -65.210ms] or [-43.556%; -32.997%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0

  • unstable execution_time [-47.927ms; -23.479ms] or [-24.970%; -12.233%]
  • unstable throughput [-366422.815op/s; -190308.765op/s] or [-28.362%; -14.730%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan netcoreapp3.1

  • unstable execution_time [-93.779ms; -71.693ms] or [-46.075%; -35.224%]
  • 🟩 throughput [+104303.246op/s; +111682.951op/s] or [+10.359%; +11.092%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net6.0

  • unstable execution_time [-71.723ms; -46.526ms] or [-35.818%; -23.235%]
  • unstable throughput [-109455.243op/s; -35824.951op/s] or [-19.875%; -6.505%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes netcoreapp3.1

  • unstable execution_time [-71.477ms; -43.999ms] or [-35.913%; -22.107%]

scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net6.0

  • unstable execution_time [-78.881ms; -49.411ms] or [-39.455%; -24.714%]
  • unstable throughput [-211627.150op/s; -66352.156op/s] or [-23.644%; -7.413%]

scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin netcoreapp3.1

  • unstable execution_time [-55.239ms; -27.496ms] or [-28.055%; -13.965%]

Known flaky benchmarks without significant changes:

  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_AddEvent_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_GetContext_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetAttributes_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_SetStatus_Sampled net6.0
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.ActivityBenchmark.StartSpan_UpdateName_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_AddEvent_Sampled netcoreapp3.1
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_GetContext_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_RecordException_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetAttributes_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled net472
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_SetStatus_Sampled netcoreapp3.1
  • scenario:Benchmarks.OpenTelemetry.InstrumentedApi.Trace.TelemetrySpanBenchmark.StartSpan_UpdateName_Sampled net472
  • scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net472
  • scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net472
  • scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net6.0
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark netcoreapp3.1
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net6.0
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net472
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net6.0
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net472
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice netcoreapp3.1
  • scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net472
  • scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net472
  • scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net472
  • scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net472
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net472
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net472
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net472
  • scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net472

@andrewlock
andrewlock merged commit 2e96cb7 into master May 19, 2026
143 checks passed
@andrewlock
andrewlock deleted the andrew/fix-asm-request-headers branch May 19, 2026 11:13
@github-actions github-actions Bot added this to the vNext-v3 milestone May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@e-n-0 e-n-0 e-n-0 approved these changes
@NachoEchevarria NachoEchevarria NachoEchevarria approved these changes

Assignees

No one assigned

Labels

area:asm identified-by:ai type:bug

Projects

None yet

Milestone

3.45.0

Development

Successfully merging this pull request may close these issues.

3 participants

@andrewlock @e-n-0 @NachoEchevarria