From: Sergey Kandaurov <pluknet@nginx.com>
Date: Wed, 15 Jul 2026 11:08:30 +0000 (+0400)
Subject: HTTP/2: reject requests with out-of-order pseudo-headers
X-Git-Tag: release-1.31.3~14
X-Git-Url: http://git.kaiwu.me/http/doc/$%7BGITURL%7D/static/gitweb.js?a=commitdiff_plain;h=a277069b1473936add8b9fc8660bf9a466ff96af;p=nginx.git

HTTP/2: reject requests with out-of-order pseudo-headers

Handling of pseudo-headers is refactored to be more in line with
HTTP/3 implementation, that is, a request line is now constructed
as soon as pseudo-headers are followed by regular fields.  Here
this plugs a missing handling for absent mandatory or out-of-order
pseudo-headers.

Such requests are now rejected immediately as malformed.

Closes: https://github.com/nginx/nginx/issues/1526
---

diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index f8f876725..ebf724d8e 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -1803,6 +1803,10 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
         return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
     }
 
+    if (ngx_http_v2_construct_request_line(r) != NGX_OK) {
+        goto error;
+    }
+
     if (r->invalid_header) {
         cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
 
@@ -3303,6 +3307,13 @@ ngx_http_v2_pseudo_header(ngx_http_request_t *r, ngx_http_v2_header_t *header)
     header->name.len--;
     header->name.data++;
 
+    if (r->request_line.len) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent out of order pseudo-headers");
+
+        return NGX_DECLINED;
+    }
+
     switch (header->name.len) {
     case 4:
         if (ngx_memcmp(header->name.data, "path", sizeof("path") - 1)
@@ -3577,6 +3588,10 @@ ngx_http_v2_construct_request_line(ngx_http_request_t *r)
 
     static const u_char ending[] = " HTTP/2.0";
 
+    if (r->request_line.len) {
+        return NGX_OK;
+    }
+
     if (r->method_name.len == 0
         || r->schema.len == 0
         || r->unparsed_uri.len == 0)