CVS: cvs.openbsd.org: src
Rafael Sadowski <[email protected]>
| Newsgroups | gmane.os.openbsd.cvs |
|---|---|
| Message-ID | <[email protected]> |
CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/07/14 02:56:00 Modified files: usr.sbin/relayd: relay_http.c Log message: relayd: reject duplicate Content-Length headers with 400 Only Host was marked unique, so a request with two Content-Length fields was framed on the last value but forwarded with both, allowing a backend to desync and smuggle a request past the filter rules. Mark Content-Length unique so the second occurrence is rejected in kv_add(). OK kirill@