[Bug] HTTP/2 body duplication fix in #3559 is incomplete — _body_complete never set in normal h2 flow

[benleembruggen]

Type

Bug Report

Description

Summary

PR #3559 (shipped in 25.3.0) added a guard in the receive() closure's streaming path to set body_received = True when stream._body_complete is True. This was intended to prevent the fast path from re-reading already-consumed data from BytesIO, which caused HTTP/2 request bodies to be doubled.

However, _body_complete is never set to True in the normal HTTP/2 event flow, so the guard never fires and the body duplication still occurs.

Root Cause

In gunicorn/http2/connection.py, the h2 "end of stream" signal is handled by _handle_stream_ended(), which sets:

stream.request_complete = True

But it does not set:

stream._body_complete = True

Meanwhile, _handle_data_received() always calls stream.receive_data(data, end_stream=False) — so _body_complete is never set from the data path either.

Steps to Reproduce (for bugs)

1. Run gunicorn 25.3.0 with an ASGI app (e.g. FastAPI) with TLS enabled (HTTP/2 requires TLS)
2. Send an HTTP/2 POST with a JSON body:

curl -v --http2 --cacert ca.crt \
  -X POST https://localhost:8080/endpoint \
  -H "Content-Type: application/json" \
  -d '{"key": "value"}'

3. Response: 422 with {"detail":[{"type":"json_invalid","loc":["body",16],"msg":"JSON decode error","input":{},"ctx":{"error":"Extra data"}}]}

Configuration

No response

Logs / Error Output

No response

Gunicorn Version

25.3.0

Python Version

3.12

Worker Class

asgi (beta)

Operating System

macOS 15.7.4

Additional Context

No response

Checklist

• I have searched existing discussions and issues for duplicates
• I have checked the documentation and FAQ