CVS: cvs.openbsd.org: src

Rafael Sadowski <[email protected]>
Newsgroups gmane.os.openbsd.cvs
Message-ID <[email protected]>
CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/07/14 02:56:00

Modified files:
	usr.sbin/relayd: relay_http.c 

Log message:
relayd: reject duplicate Content-Length headers with 400

Only Host was marked unique, so a request with two Content-Length
fields was framed on the last value but forwarded with both, allowing
a backend to desync and smuggle a request past the filter rules. Mark
Content-Length unique so the second occurrence is rejected in kv_add().

OK kirill@
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.