Repository navigation
Harden HTTP/2 CR/LF in trailer header values #68371
Description
Kestrel correctly rejects \r and \n in regular HTTP/2 request header literals, but skips that check in two places:
- Request trailers —
HttpProtocol.OnTrailercallsGetRequestHeaderString(..., checkForNewlineChars: false), so a trailer value containing CR or LF is stored inRequestTrailerswithout error. - HPACK dynamic-table retrieval — when a header is referenced by dynamic-table index and has no static-table alias,
Http2Connection.OnHeaderCoredispatches withcheckForNewlineChars: false.
RFC 7540 §10.3 requires CR/LF inside a header field value to be treated as a stream/connection error.
Activity
amf-fs commentedon Aug 14, 2026
Hi @DeagleGross, I did a quick check in both paths, and it looks like we just need to turn on the validation
GetRequestHeaderString(..., checkForNewlineChars: true).I’m still figuring out the networking internals, so I’d like to confirm the approach before proceeding. Thanks!
DeagleGross commentedon Aug 18, 2026
@amf-fs hey, yep, that's basically all that needs to be done. Dont forget to write the unit-tests to lockdown the behavior and make sure change works correctly. Thanks!
amf-fs commentedon Aug 24, 2026
Thanks for the clarification. PR submitted; glad to contribute.