Reject empty HTTP/2 header names

ninenines · Oct 1, 2019 · 7f0978d · 7f0978d
1 parent 1d29045
commit 7f0978d
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/cow_http2_machine.erl b/src/cow_http2_machine.erl
@@ -659,6 +659,8 @@ headers_regular_headers(Frame=#headers{id=StreamID},
 			stream_reset(StreamID, State, protocol_error, HumanReadable)
 	end.
 
+regular_headers([{<<>>, _}|_], _) ->
+	{error, 'Empty header names are not valid regular headers. (CVE-2019-9516)'};
 regular_headers([{<<":", _/bits>>, _}|_], _) ->
 	{error, 'Pseudo-headers were found after regular headers. (RFC7540 8.1.2.1)'};
 regular_headers([{<<"connection">>, _}|_], _) ->