From: felix h Date: Wed, 5 Aug 2026 17:07:20 +0000 (+0200) Subject: Upstream: reject zero WINDOW_UPDATE increments X-Git-Tag: release-1.31.4~9 X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=3c65267a0c60e616bce9789978795c54e18456c6;p=nginx.git Upstream: reject zero WINDOW_UPDATE increments The HTTP/2 proxy and gRPC upstream clients accepted WINDOW_UPDATE frames with a zero flow-control window increment. RFC 9113 requires such frames to be handled as PROTOCOL_ERROR at stream or connection scope. Reject these frames as invalid upstream responses. --- diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c index 6f1752e54..1aecc5aeb 100644 --- a/src/http/modules/ngx_http_grpc_module.c +++ b/src/http/modules/ngx_http_grpc_module.c @@ -3865,6 +3865,12 @@ ngx_http_grpc_parse_window_update(ngx_http_request_t *r, ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "grpc window update: %ui", ctx->window_update); + if (ctx->window_update == 0) { + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, + "upstream sent zero window update"); + return NGX_ERROR; + } + if (ctx->stream_id) { if (ctx->window_update > (size_t) NGX_HTTP_V2_MAX_WINDOW diff --git a/src/http/modules/ngx_http_proxy_v2_module.c b/src/http/modules/ngx_http_proxy_v2_module.c index cc3f090ca..337561f2d 100644 --- a/src/http/modules/ngx_http_proxy_v2_module.c +++ b/src/http/modules/ngx_http_proxy_v2_module.c @@ -3690,6 +3690,12 @@ ngx_http_proxy_v2_parse_window_update(ngx_http_request_t *r, ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "http proxy window update: %ui", ctx->window_update); + if (ctx->window_update == 0) { + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, + "upstream sent zero window update"); + return NGX_ERROR; + } + if (ctx->stream_id) { if (ctx->window_update > (size_t) NGX_HTTP_V2_MAX_WINDOW