net/http: `expect: 100-continue` handling is broken in various ways [1.21 backport]

[gopherbot]

@neild requested issue #67555 to be considered for backport to the next 1.21 minor release.

@gopherbot please open backport issues. This is a significant bug with no workaround.

[gabyhelp]

Similar Issues

• net/http: `expect: 100-continue` handling is broken in various ways [1.22 backport] #68200
• x/net/http2: Client doesn't send body until ExpectContinueTimeout expires [1.17 backport] #49905
• x/net/http2: Client doesn't send body until ExpectContinueTimeout expires [1.16 backport] #49904
• x/net/http2: frequent failures in TestClientConnCloseAtBody [1.17 backport] #49911
• net/http: bad handling of HEAD requests with a body [1.19 backport] #56154
• net/http: HTTP/2 response body Close method sometimes returns spurious context cancelation error (1.17.3 regression) [1.17 backport] #49559
• x/net/http2: frequent failures in TestClientConnCloseAtBody [1.16 backport] #49910
• net/http: improper sanitization of Transfer-Encoding header [1.17 backport] #53432
• net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/net@v0.23.0 [1.21 backport] #66697
• net/http: close connections when receiving too many headers (CVE-2023-45288) [1.21 backport] #65387

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/595096 mentions this issue: [release-branch.go1.21] net/http: send body or close connection on expect-100-continue requests

[gopherbot]

Closed by merging c9be6ae to release-branch.go1.21.

[thanm]

From the security team related to this issue:

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

Thanks to Geoff Franks for reporting this issue.

This is CVE-2024-24791.