Skip to content

Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table - #68743

Merged
DeagleGross merged 8 commits into
dotnet:mainfrom
amf-fs:bug/68371-harden-http2-cr-lf
Sep 9, 2026
Merged

Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table#68743
DeagleGross merged 8 commits into
dotnet:mainfrom
amf-fs:bug/68371-harden-http2-cr-lf

Conversation

@amf-fs

@amf-fs amf-fs commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table

  • You've read the Contributor Guide and Code of Conduct.
  • You've included unit or integration tests for your change, where applicable.
  • You've included inline docs for your change, where applicable.
  • There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Description

Kestrel previously skipped validation for CR/LF in two places: request trailers and HPACK dynamic table retrieval. Based on RFC 7540 section 10.3, these values must be treated as malformed. The validation for newline characters has now been enabled along with tests to ensure compliance.

Fixes #68371

@dotnet-policy-service dotnet-policy-service Bot added the community-contribution Indicates that the PR has been added by a community member label Aug 24, 2026
@dotnet-policy-service

dotnet-policy-service Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Thanks for your PR, @amf-fs. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

@amf-fs

amf-fs commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

@dotnet-policy-service agree

@amf-fs amf-fs changed the title Fix: hardening http2 to refuse new line chars on trailers and dynamic HPACK table cr lf Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table Aug 24, 2026
DeagleGross
DeagleGross reviewed Aug 27, 2026
View reviewed changes
Comment thread src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2StreamTests.cs Outdated
Comment thread src/Servers/Kestrel/Core/src/Internal/Http2/Http2Connection.cs
@Youssef1313 Youssef1313 added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label Sep 2, 2026
@DeagleGross
DeagleGross merged commit fbfbcd1 into dotnet:main Sep 9, 2026
28 checks passed
@DeagleGross

DeagleGross commented Sep 9, 2026

Copy link
Copy Markdown
Member

thanks for contribution @amf-fs !

@dotnet-maestro dotnet-maestro Bot mentioned this pull request Sep 10, 2026
Merged
@dotnet-milestone-bot dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Sep 10, 2026
@amf-fs
amf-fs deleted the bug/68371-harden-http2-cr-lf branch September 10, 2026 12:55
This was referenced Sep 11, 2026
Merged
Merged
Merged
Merged
This was referenced Sep 14, 2026
Merged
Merged
chan-sky pushed a commit to chan-sky/aspnetcore that referenced this pull request Sep 16, 2026
@amf-fs @BrennanConroy
Fix: hardening http2 to refuse newline chars on trailers and dynamic …
368df0d 
…HPACK table (dotnet#68743)

* Hardening trailers to refuse new line chars

* Hardening HPACK dynamic header to refuse new line chars

* Http3 request trailers with newline chars test

* Added test to exercise newline chars on indexed headers
chan-sky pushed a commit to chan-sky/aspnetcore that referenced this pull request Sep 16, 2026
@amf-fs @BrennanConroy
Fix: hardening http2 to refuse newline chars on trailers and dynamic …
9bf5d8c 
…HPACK table (dotnet#68743)

* Hardening trailers to refuse new line chars

* Hardening HPACK dynamic header to refuse new line chars

* Http3 request trailers with newline chars test

* Added test to exercise newline chars on indexed headers
chan-sky pushed a commit to chan-sky/aspnetcore that referenced this pull request Sep 16, 2026
@amf-fs @BrennanConroy
Fix: hardening http2 to refuse newline chars on trailers and dynamic …
cb35195 
…HPACK table (dotnet#68743)

* Hardening trailers to refuse new line chars

* Hardening HPACK dynamic header to refuse new line chars

* Http3 request trailers with newline chars test

* Added test to exercise newline chars on indexed headers
DeagleGross pushed a commit to DeagleGross/aspnetcore that referenced this pull request Sep 16, 2026
@amf-fs @BrennanConroy
Fix: hardening http2 to refuse newline chars on trailers and dynamic …
28add94 
…HPACK table (dotnet#68743)

* Hardening trailers to refuse new line chars

* Hardening HPACK dynamic header to refuse new line chars

* Http3 request trailers with newline chars test

* Added test to exercise newline chars on indexed headers
wtgodbe added a commit that referenced this pull request Sep 16, 2026
@wtgodbe @BrennanConroy
@amf-fs @github-actions @jakobbotsch @SamMonoRT @DeagleGross @dotnet-maestro @rokonec
[automated] Merge branch 'release/11.0' => 'main' (#69251)
db584f6 
* [SignalR] Fix CTS disposal (#69158)

* Fix: hardening http2 to refuse newline chars on trailers and dynamic HPACK table (#68743)

* Hardening trailers to refuse new line chars

* Hardening HPACK dynamic header to refuse new line chars

* Http3 request trailers with newline chars test

* Added test to exercise newline chars on indexed headers

* Fix flaky HTTP/3 request trailers test

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* [SignalR] [Java] Fix hang when reading an HTTP response body fails (#69037) (#69206)

Co-authored-by: Brennan <brecon@microsoft.com>

* Add AggressiveOptimization to key long-running async methods (#69287)

* [DirectTLS] [release/11.0] exclude experimental transport from release 11 (#69144)

* Revert "Run DirectTls handshake user callbacks off the epoll pump thread (#68664)"

This reverts commit 49e0516.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Revert "[Experimental] DirectTls transport implementation (#67912)"

This reverts commit 07d11eb.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Apply suggestion from @DeagleGross

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update dependencies from https://github.com/dotnet/extensions build 20260909.4 (#69269)

On relative base path root
Microsoft.Extensions.Caching.Hybrid , Microsoft.Extensions.Diagnostics.Testing , Microsoft.Extensions.ServiceDiscovery , Microsoft.Extensions.ServiceDiscovery.Yarp , Microsoft.Extensions.TimeProvider.Testing From Version 10.9.0 -> To Version 10.10.0

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

* [release/11.0] Source code updates from dotnet/dotnet (#69256)

* Backflow from https://github.com/dotnet/dotnet / e775569 build 331727

Diff: https://github.com/dotnet/dotnet/compare/48e3f46c03e3ed36611a49fd7107330dade9f7c8..e775569ca8ce94c363d910311f5f889e648ddc23

From: dotnet/dotnet@48e3f46
To: dotnet/dotnet@e775569

[[ commit created by automation ]]

* Update dependencies from build 331727
Updated Dependencies:
Microsoft.NET.Runtime.WebAssembly.Sdk, Microsoft.NETCore.BrowserDebugHost.Transport, Microsoft.NET.Runtime.MonoAOTCompiler.Task, dotnet-ef, Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.Cryptography, Microsoft.Bcl.TimeProvider, Microsoft.EntityFrameworkCore, Microsoft.EntityFrameworkCore.Design, Microsoft.EntityFrameworkCore.InMemory, Microsoft.EntityFrameworkCore.Relational, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.SqlServer, Microsoft.EntityFrameworkCore.Tools, Microsoft.Extensions.Caching.Abstractions, Microsoft.Extensions.Caching.Memory, Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions, Microsoft.Extensions.Configuration.Binder, Microsoft.Extensions.Configuration.CommandLine, Microsoft.Extensions.Configuration.EnvironmentVariables, Microsoft.Extensions.Configuration.FileExtensions, Microsoft.Extensions.Configuration.Ini, Microsoft.Extensions.Configuration.Json, Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Configuration.Xml, Microsoft.Extensions.DependencyInjection, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.DependencyModel, Microsoft.Extensions.Diagnostics, Microsoft.Extensions.Diagnostics.Abstractions, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.FileProviders.Composite, Microsoft.Extensions.FileProviders.Physical, Microsoft.Extensions.FileSystemGlobbing, Microsoft.Extensions.HostFactoryResolver.Sources, Microsoft.Extensions.Hosting, Microsoft.Extensions.Hosting.Abstractions, Microsoft.Extensions.Http, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Logging.Configuration, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.Logging.Debug, Microsoft.Extensions.Logging.EventLog, Microsoft.Extensions.Logging.EventSource, Microsoft.Extensions.Logging.TraceSource, Microsoft.Extensions.Options, Microsoft.Extensions.Options.ConfigurationExtensions, Microsoft.Extensions.Options.DataAnnotations, Microsoft.Extensions.Primitives, Microsoft.Internal.Runtime.AspNetCore.Transport, Microsoft.NETCore.App.Ref, Microsoft.NETCore.Platforms, System.Collections.Immutable, System.Composition, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Diagnostics.EventLog, System.Diagnostics.PerformanceCounter, System.DirectoryServices.Protocols, System.Formats.Asn1, System.Formats.Cbor, System.IO.Hashing, System.IO.Pipelines, System.Memory.Data, System.Net.Http.Json, System.Net.Http.WinHttpHandler, System.Net.ServerSentEvents, System.Numerics.Tensors, System.Reflection.Metadata, System.Resources.Extensions, System.Runtime.Caching, System.Security.Cryptography.Pkcs, System.Security.Cryptography.Xml, System.Security.Permissions, System.ServiceProcess.ServiceController, System.Text.Encodings.Web, System.Text.Json, System.Threading.AccessControl, System.Threading.Channels, System.Threading.RateLimiting (Version 11.0.0-rc.2.26458.109 -> 11.0.0-rc.2.26461.110)
Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Archives, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Helix.JobMonitor, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.RemoteExecutor, Microsoft.DotNet.SharedFramework.Sdk (Version 11.0.0-beta.26458.109 -> 11.0.0-beta.26461.110)
Microsoft.Web.Xdt (Version 3.3.0-rc.2.26458.109 -> 3.3.0-rc.2.26461.110)
NuGet.Frameworks, NuGet.Packaging, NuGet.Versioning (Version 7.12.0-rc.45909 -> 7.12.0-rc.46210)
[[ commit created by automation ]]

* Fix authorization component Razor compilation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(iis): scope upgrade MaxRequestBodySize assert to in-process hosting

- in-process must clear the limit on upgrade because its read loop enforces it
- out-of-process runs on Kestrel, which never enforces it once upgraded
- unblocks the three WebSocketsOutOfProcessTests failures

🧪 - Generated by Copilot

(cherry picked from commit befb2e9)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: William Godbe <wigodbe@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Roman Konecny <rokonecn@microsoft.com>

* Remove experimental DirectTLS transport

Carry the release/11.0 removal from #69144 into main while preserving the other auto-merge conflict resolutions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Brennan <brecon@microsoft.com>
Co-authored-by: Alan Morais Fialho <51328556+amf-fs@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jakob Botsch Nielsen <Jakob.botsch.nielsen@gmail.com>
Co-authored-by: Sam Patel <46026722+SamMonoRT@users.noreply.github.com>
Co-authored-by: Korolev Dmitry <dmkorolev@microsoft.com>
Co-authored-by: dotnet-maestro[bot] <42748379+dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: William Godbe <wigodbe@microsoft.com>
Co-authored-by: Roman Konecny <rokonecn@microsoft.com>
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Sep 17, 2026
Merged
@zakkariyaa zakkariyaa mentioned this pull request Oct 14, 2026
Open
1 task done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DeagleGross DeagleGross DeagleGross approved these changes
@halter73 halter73 Awaiting requested review from halter73 halter73 is a code owner
@BrennanConroy BrennanConroy Awaiting requested review from BrennanConroy BrennanConroy is a code owner
@SamMonoRT SamMonoRT Awaiting requested review from SamMonoRT SamMonoRT is a code owner

Assignees

No one assigned

Labels

area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions community-contribution Indicates that the PR has been added by a community member

Projects

None yet

Milestone

12.0-preview1

Development

Successfully merging this pull request may close these issues.

Harden HTTP/2 CR/LF in trailer header values

3 participants

@amf-fs @DeagleGross @Youssef1313