Skip to content

HTTPDecoder: restore old limit of 80 kB headers#3621

Open
weissi wants to merge 1 commit into
apple:mainfrom
weissi:jw-restore-limit
Open

HTTPDecoder: restore old limit of 80 kB headers#3621
weissi wants to merge 1 commit into
apple:mainfrom
weissi:jw-restore-limit

Conversation

@weissi

@weissi weissi commented Jun 11, 2026

Copy link
Copy Markdown
Member

Motivation:

NIO's historic limit was that the maximum header block was limited to 80 kB which is a sensible limit and originates from Nginx's http_parser.c.

The history of the changes:

  • commit e67fc99: Introduces the 80 kB limit
  • commit 6918034: Accidentally removes the limit entirely
  • commit b24872d: Introduced the 2 MB / 256 headers limit

I would argue that 2MB & 256 headers is a bad limit:

  • 2MB is way too big, that allows pretty powerful slowloris-style attacks forcing NIO to hold on to 2 MB per connection
  • 256 headers is too little for software that may be a proxy
    • in HTTP, the number of headers is non-semantic
      • A: a: 1\r\n a: 2\r\n a: 3\r\n a: 4\r\n a: 5\r\n a: 6\r\n[...]\r\na: 257\r\n
      • B: a: 1, 2, 3, 4, 5, ..., 257\r\n
      • A & B are equivalent. Yet, A would be rejected and B accepted. That's not right.

Modifications:

Restore the old limits.

Result:

  • More compatible (because we allow more than 256 headers)
  • More secure (because the default goes back to 80kB)

@weissi weissi requested review from Lukasa and fabianfett June 11, 2026 16:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant