https://bz.apache.org/bugzilla/show_bug.cgi?id=70304
Bug ID: 70304
Summary: RFC 9113 §6.4: RST_STREAM with wrong payload length
should be a FRAME_SIZE_ERROR connection error
Product: Tomcat 11
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -------
RFC 9113, section 6.4 states:
"A RST_STREAM frame with a length other than 4 octets MUST be treated as a
connection error (Section 5.4.1) of type FRAME_SIZE_ERROR."
FrameType.java declares RST with payloadErrorFatal=false. When a RST_STREAM
frame arrives with a payload length other than 4 bytes on a non-zero stream,
FrameType.check() falls into the stream-error branch and sends RST_STREAM back
to the client. RFC 9113 §6.4 requires a GOAWAY (connection error) instead.
Fix: set payloadErrorFatal=true for RST in FrameType.java so that
FrameType.check() always throws ConnectionException for a malformed RST_STREAM
payload.
For reference:
- PRIORITY (§6.3) — "stream error" → payloadErrorFatal=false (correct)
- WINDOW_UPDATE (§6.9) — "connection error" → payloadErrorFatal=true (correct)
- RST (§6.4) — "connection error" → payloadErrorFatal=false (BUG)
PR: https://github.com/apache/tomcat/pull/1141
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
