POJIA破甲
地图 / Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1

Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1

注入与走私 / HTTP 请求走私 / #3793495

厂商
curl
严重程度
低危
赏金
—
弱点
HTTP 请求走私
研究员
@unknowperson0212
披露日期
2026-06-15
资产
https://github.com/curl/curl
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(1574 字符中的一小部分)
When curl send a request with `Transfer-Encoding: chunked` using HTTP/1.1, and follows a redirect to an HTTP/2 endpoint, the `upload_chunky` flag is not properly reset. As a result, the `Transfer-Encoding: chunked` header is sent in the subsequent request even when HTTP/2 is negotiated/used.
原文中的代码
curl -vvv --http1.1 --no-alpn -L --http2 -k \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: text/plain" \
  -d "This is chunked encoding bug test data" \
  http://test.local:8080/

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @unknowperson0212 · 版权归作者与 curl 所有

同类报告

Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-07 · $20,000Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-07 · $18,900Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09Password theft login.newrelic.com via Request SmugglingNew Relic · — · $3,000