]> git.kaiwu.me - nginx.git/commit
Request body: flood detection for chunked request body
authorSourav Bhowmik <s.bhowmik@f5.com>
Tue, 4 Aug 2026 13:34:19 +0000 (06:34 -0700)
committerSergey Kandaurov <pluknet@nginx.com>
Wed, 4 Nov 2026 20:42:24 +0000 (00:42 +0400)
commita4b482207d442359746b658b522975dc82e455b2
treec8a80ffb6c78b8c60c4d87e55a8b2c0ebe845e07
parentcc1bbc7f7e32195928f89d9a652b38fe9c975c8e
Request body: flood detection for chunked request body

Chunk sizes (including leading zeros), chunk extensions and trailers
of a chunked request body were not accounted, allowing a client to send
an unbounded amount of framing with little or no body data.

Now all received bytes are counted in rb->received and compared to
the body data, using the same flood detection as in HTTP/2 and HTTP/3.

Reported by jskoetsier.
src/http/ngx_http_request_body.c