11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first
身份认证 / Authentication Bypass by Primary Weakness / #3973121
该报告还没有中文解读。
原文摘录
摘自原文(5890 字符中的一小部分)
When HTTP/2 transfers share a multiplexed connection, `CURLOPT_FORBID_REUSE` set by a transfer that completes before the other active stream(s) is silently discarded. The connection survives into the idle pool and can be reused by a subsequent transfer.
原文中的代码
Curl_detach_connection(data);
if(CONN_INUSE(conn)) {
/* Stop if still used. */
return;
}默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @giant_anteater · 版权归作者与 curl 所有