mod_http2/mod_http2-2.0.29-CVE-2026-49975.patch
2026-06-11 13:20:35 -04:00

37 lines
1.5 KiB
Diff

From 35c6e405390ed361189a82acd96675401ea5947c Mon Sep 17 00:00:00 2001
From: Stefan Eissing <icing@users.noreply.github.com>
Date: Wed, 27 May 2026 11:27:30 +0200
Subject: [PATCH] cookie reqest header counting (#324)
* cookie reqest header counting
Account merged cookie headers as an "add" to keep LimitRequestFields effective.
* ignore duplicate empty cookie headers
---
mod_http2/h2_util.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mod_http2/h2_util.c b/mod_http2/h2_util.c
index 605c348..58a143b 100644
--- a/mod_http2/h2_util.c
+++ b/mod_http2/h2_util.c
@@ -1708,6 +1708,8 @@ static apr_status_t req_add_header(apr_table_t *headers, apr_pool_t *pool,
&& !ap_cstr_casecmp("cookie", (const char *)nv->name)) {
existing = apr_table_get(headers, "cookie");
if (existing) {
+ if (!nv->valuelen)
+ return APR_SUCCESS;
/* Cookie header come separately in HTTP/2, but need
* to be merged by "; " (instead of default ", ")
*/
@@ -1719,6 +1721,8 @@ static apr_status_t req_add_header(apr_table_t *headers, apr_pool_t *pool,
apr_table_setn(headers, "Cookie",
apr_psprintf(pool, "%s; %.*s", existing,
(int)nv->valuelen, nv->value));
+ /* Treat the merge as an "add" to not escape LimitRequestFields */
+ *pwas_added = 1;
return APR_SUCCESS;
}
}