You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2025/06/12 10:57:53 UTC
[Bug 69713] New: HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
Bug ID: 69713
Summary: HTTP/2 DATA frame with padding cause error when
HEADERS contains content-length field.
Product: Tomcat 10
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: enhancement
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: kinyuka@gmail.com
Target Milestone: ------
When HEADERS contains 'content-length' field and DATA frame is padded, it
causes Connection error.
tomcat-1 | 12-Jun-2025 02:18:55.721 FINE [https-openssl-nio-8443-exec-4]
org.apache.coyote.http2.Http2UpgradeHandler.upgradeDispatch Connection error
tomcat-1 | org.apache.coyote.http2.ConnectionException: Connection [0],
Stream [1], The content length header value [3] does not agree with the size of
the data received [127]
tomcat-1 | at
org.apache.coyote.http2.Stream.receivedData(Stream.java:684)
tomcat-1 | at
org.apache.coyote.http2.Http2UpgradeHandler.startRequestBodyFrame(Http2UpgradeHandler.java:1553)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncUpgradeHandler.startRequestBodyFrame(Http2AsyncUpgradeHandler.java:43)
tomcat-1 | at
org.apache.coyote.http2.Http2Parser.readDataFrame(Http2Parser.java:191)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser$FrameCompletionHandler.completed(Http2AsyncParser.java:251)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser$FrameCompletionHandler.completed(Http2AsyncParser.java:167)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase$VectoredIOCompletionHandler.completed(SocketWrapperBase.java:1040)
tomcat-1 | at
org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper$NioOperationState.run(NioEndpoint.java:1687)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase$OperationState.start(SocketWrapperBase.java:987)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.vectoredOperation(SocketWrapperBase.java:1358)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.read(SocketWrapperBase.java:1214)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.read(SocketWrapperBase.java:1190)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser.readFrame(Http2AsyncParser.java:140)
tomcat-1 | at
org.apache.coyote.http2.Http2Parser.readFrame(Http2Parser.java:87)
tomcat-1 | at
org.apache.coyote.http2.Http2UpgradeHandler.upgradeDispatch(Http2UpgradeHandler.java:356)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncUpgradeHandler.upgradeDispatch(Http2AsyncUpgradeHandler.java:43)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser$PrefaceCompletionHandler.completed(Http2AsyncParser.java:130)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser$PrefaceCompletionHandler.completed(Http2AsyncParser.java:62)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase$VectoredIOCompletionHandler.completed(SocketWrapperBase.java:1040)
tomcat-1 | at
org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper$NioOperationState.run(NioEndpoint.java:1687)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase$OperationState.start(SocketWrapperBase.java:987)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.vectoredOperation(SocketWrapperBase.java:1358)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.read(SocketWrapperBase.java:1214)
tomcat-1 | at
org.apache.tomcat.util.net.SocketWrapperBase.read(SocketWrapperBase.java:1190)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncParser.readConnectionPreface(Http2AsyncParser.java:57)
tomcat-1 | at
org.apache.coyote.http2.Http2UpgradeHandler.init(Http2UpgradeHandler.java:248)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncUpgradeHandler.init(Http2AsyncUpgradeHandler.java:43)
tomcat-1 | at
org.apache.coyote.http2.Http2UpgradeHandler.upgradeDispatch(Http2UpgradeHandler.java:334)
tomcat-1 | at
org.apache.coyote.http2.Http2AsyncUpgradeHandler.upgradeDispatch(Http2AsyncUpgradeHandler.java:43)
tomcat-1 | at
org.apache.coyote.http11.upgrade.UpgradeProcessorInternal.dispatch(UpgradeProcessorInternal.java:60)
tomcat-1 | at
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:57)
tomcat-1 | at
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903)
tomcat-1 | at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1769)
tomcat-1 | at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
tomcat-1 | at
org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1189)
tomcat-1 | at
org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:658)
tomcat-1 | at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
tomcat-1 | at java.base/java.lang.Thread.run(Thread.java:1583)
The test of padded DATA frame is here
https://github.com/apache/tomcat/blob/main/test/org/apache/coyote/http2/Http2TestBase.java#L388
https://github.com/apache/tomcat/blob/main/test/org/apache/coyote/http2/TestHttp2Section_6_1.java#L50
But it tests only the case that HEADERS frame does not contain 'content-length'
field.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
--- Comment #7 from Nirbhay <nn...@gmail.com> ---
I have raised this bug https://bz.apache.org/bugzilla/show_bug.cgi?id=69770
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
Correctly handle an HTTP/2 data frame that includes
padding when the headers include a content-length. (remm/markt)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
Matafagafo <ma...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |matafagafo@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
--- Comment #1 from Remy Maucherat <re...@apache.org> ---
Created attachment 40047
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40047&action=edit
Proposed patch
Http2Parser.readDataFrame has two suspicious uses of payloadSize when
dataLength should be used instead.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
--- Comment #2 from Mark Thomas <ma...@apache.org> ---
We might want to update a few method parameter names for consistency as well.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |FIXED
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
The change to fix this bug changed the handling for reading DATA frames, not
writing them.
I don't see any errors browsing static files with Chrome (or FireFox).
Downloading of a large (500MB+) static file also worked without errors.
I have built and deployed the one page sample app for requirejs and that loads
without any issues in a 10.1.x Tomcat instance built from the latest source.
I'm not seeing evidence to support the assertion that there is a regression in
the fix for this issue.
If there is a Tomcat issue here, it looks to be unrelated to this fix.
Please open a new issue and provide a minimal test case (based on the report a
WAR with only static files should be sufficient) that demonstrates the issue.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 11.0.x for 11.0.9 onwards
- 10.1.x for 10.1.43 onwards
- 9.0.x for 9.0.107 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69713] HTTP/2 DATA frame with padding cause error when HEADERS contains content-length field.
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69713
Nirbhay <nn...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |---
--- Comment #5 from Nirbhay <nn...@gmail.com> ---
**REGRESSION REPORT: HTTP/2 Data Frame Handling in 10.1.43 (Bug 69713)**
**Environment:**
- Tomcat Version: 10.1.43 (regression), 10.1.42 (works fine)
- Browser: Chrome/Firefox (both affected)
- Protocol: HTTP/2 over HTTP (port 8080)
- Content: Static files (HTML, CSS, JS)
**Issue Description:**
After upgrading from Tomcat 10.1.42 to 10.1.43, our web application's frontend
fails to load static resources due to HTTP/2 protocol errors.
**Error Symptoms:**
1. Browser Console: `ERR_HTTP2_PROTOCOL_ERROR 200 (OK)`
2. Frontend module loader timeouts: `Load timeout for modules:
text!/com/path/file.html`
3. HTTP status is 200, but browser rejects the response due to protocol
violation
4. Static files (HTML/CSS/JS) affected, dynamic content works
**Root Cause Analysis:**
The issue correlates directly with **Fix 69713**: "Correctly handle an HTTP/2
data frame that includes padding when the headers include a content-length."
**Suspected Problem:**
The fix appears to have introduced a regression in HTTP/2 frame construction
where:
- Data frames with both padding and content-length headers are malformed
- Browsers interpret these as HTTP/2 protocol violations
- The "fix" may be too strict or incorrectly handling frame boundaries/padding
**Reproduction:**
1. Deploy any web app with static files on Tomcat 10.1.43
2. Enable HTTP/2 (`<UpgradeProtocol
className="org.apache.coyote.http2.Http2Protocol" />`)
3. Access static resources via frontend module loaders (RequireJS, AMD, etc.)
4. Observe ERR_HTTP2_PROTOCOL_ERROR in browser console
**Workaround:**
- Revert to Tomcat 10.1.42, or
- Disable HTTP/2 in server.xml
**Request:**
Please review the HTTP/2 data frame construction logic introduced in Fix 69713
for browser compatibility. The fix may be causing valid responses to be
formatted in a way that violates HTTP/2 specification from the browser's
perspective.
**Impact:**
Production web applications with HTTP/2 enabled cannot serve static content
reliably.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org