apple / swift-nio-http2

HTTP/2 support for SwiftNIO
https://swiftpackageindex.com/apple/swift-nio-http2/main/documentation/niohttp2
Apache License 2.0
465 stars 82 forks source link

Reject long sequences of CONTINUATION frames #443

Closed clintonpi closed 4 months ago

clintonpi commented 4 months ago

Motivation:

Long sequences of CONTINUATION frames can be used to mount attacks by attempting to get a remote peer to consume large amounts of memory.

Modifications:

Result:

Long sequences of CONTINUATION frames are now rejected by the recipient.

glbrntt commented 4 months ago

@swift-server-bot add to allowlist