[Bug] HTTP/2 ASGI body duplication - request body delivered twice via receive()

[benleembruggen]

Type

Bug Report

Description

When using HTTP/2 with an ASGI worker, the request body is delivered to the application twice, resulting in corrupted/doubled request bodies. HTTP/1.1 over TLS on the same endpoint works correctly.

Steps to Reproduce (for bugs)

1. Create minimal server

# app.py
from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse

app = FastAPI()

@app.post("/test")
async def test(request: Request):
   body = await request.body()
   return JSONResponse({"len": len(body), "body": body.decode()})```

2. Start with gunicorn

gunicorn -k asgi \
  --certfile cert.pem --keyfile key.pem \
  --http-protocols h2,h1 \
  --bind 0.0.0.0:8443 \
  "app:app"

3. Make curl requests

# HTTP/2 — body is doubled (36 bytes instead of 18)
$ curl --http2 -k -X POST 'https://localhost:8443/test' \
    -H 'Content-Type: application/json' \
    -d'{"input":["aaaa"]}'
{"len":36,"body":"{\"input\":[\"aaaa\"]}{\"input\":[\"aaaa\"]}"}

# HTTP/1.1 — correct (18 bytes)
$ curl --http1.1 -k -X POST 'https://localhost:8443/test' \
    -H 'Content-Type: application/json' \
    -d'{"input":["aaaa"]}'
{"len":18,"body":"{\"input\":[\"aaaa\"]}"}

Configuration

No response

Logs / Error Output

No response

Gunicorn Version

gunicorn 25.2.0

Python Version

Python 3.12.0

Worker Class

asgi (beta)

Operating System

macOS 15.7.4

Additional Context

Root cause

HTTP2Stream.receive_data() (stream.py:129) writes every DATA frame to both stores:

def receive_data(self, data, end_stream=False):
    if data:
        self._body_chunks.append(data)    # Store A: for streaming reads
    self.request_body.write(data)          # Store B: BytesIO for fast path

The receive() closure in _handle_http2_request() (protocol.py:1297) has two read paths:

async def receive():
    nonlocal body_received

    # Path A: fast path — reads from BytesIO
    if not body_received and stream.request_complete and not stream._body_chunks:
        body_received = True
        body = stream.get_request_body()
        return {"type": "http.request", "body": body, "more_body": False}

    # Path B: streaming — pops from _body_chunks
    chunk = await stream.read_body_chunk()
    ...
    return {"type": "http.request", "body": chunk, "more_body": not stream._body_complete}
    # ← body_received is never set to True here

Sequence:

1. DATA frame arrives → 18 bytes stored in both _body_chunks and request_body
2. 1st receive(): _body_chunks non-empty → Path B → pops 18 bytes, returns more_body: False
3. 2nd receive(): _body_chunks empty, request_complete=True, body_received=False → Path A → reads 18 bytes again from BytesIO
4. App receives 36 bytes → JSON parse fails with “Extra data”

Proposed fix

Set body_received = True in Path B when the body is complete, preventing Path A from firing:

# In the streaming return path:
if stream._body_complete:
    body_received = True

return {
    "type": "http.request",
    "body": chunk,
    "more_body": not stream._body_complete,
}

Checklist

• I have searched existing discussions and issues for duplicates
• I have checked the documentation and FAQ

[benleembruggen]

Fix here: #3559

[benoitc]

Sorry just noticed the discussion. The fix has been merged. Thanks!