Sending a header with a newline causes a crash with HTTP/3

[DemiMarie]

I did this

I made an HTTP/3 request with `curl --http3-only -H $'a: a\x0ab' SOMEURL. Sending a newline in an HTTP header only makes sense if (as I was) one is trying to test a web server (in my case a custom patch for NGINX), but I was not expecting to get:

curl: nghttp3_conn.c:2463: nghttp3_conn_shutdown_stream_read: Assertion `stream_id >= 0' failed.

and a core dump.

I don’t consider this a security vulnerability because the documentation is very clear that it is the application’s job to sanitize headers passed to curl, and indeed if the request was made using HTTP/1.x then allowing newlines in headers leads to header value injection or even request smuggling. Other invalid header values (like a: \x01) don’t trigger this issue.

I expected the following

I’m not sure. Perhaps curl should give an error stating that newlines aren’t allowed in headers. In any case, curl shouldn’t crash.

curl/libcurl version

curl 8.13.0 (x86_64-pc-linux-gnu) libcurl/8.13.0 OpenSSL/3.4.1 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.7 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.65.0 nghttp3/1.8.0
Release-Date: 2025-04-02
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

operating system

Linux nginx 6.12.21-1.qubes.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Mar 31 11:38:40 GMT 2025 x86_64 GNU/Linux

[icing]

Thanks for the report @DemiMarie . This is indeed a bug in curl's experimental HTTP/3 support with OpenSSL's own QUIC stack.

A new test case and fix in #17003. Would appreciate if you could verify this works for you as well. Thanks!

[DemiMarie]

@icing thanks for the fix! I’m not sure when I’ll get around to testing this, but if the fix passes tests with sanitizers enabled it should be okay. I’ll also report a bug to Arch for building their libcurl with OpenSSL QUIC instead of ngtcp2.

[bagder]

As we believe the PR fixes this issue, we moved ahead and closed this when it merged. If you have any issues later when you get a chance to try this out, let us know!