https://bz.apache.org/bugzilla/show_bug.cgi?id=70212
Bug ID: 70212
Summary: mod_http2 leaks internal APR status codes (e.g., 70007
APR_TIMEUP) as raw HTTP/2 GOAWAY error codes
Product: Apache httpd-2
Version: 2.4.62
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_http2
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
While analyzing HTTP/2 connection terminations problems using java-grpc
(https://github.com/grpc/grpc-java/issues/13031), I observed that mod_http2
sends an invalid error code inside the GOAWAY frame header when a request or
connection timeout occurs.
Specifically, the server sent a GOAWAY frame containing the error code 70007
(APR_TIMEUP). According to the HTTP/2 specification (RFC 9113 Section 7), the
error_code field in a GOAWAY frame must be a valid HTTP/2 standard error code
(such as NO_ERROR=0).
I'm certainly not knowledgeable about apache httpd (or http2). But this seems
like a bug?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
