HTTP/2 downgrade framing disagreements

A protocol translator must preserve message boundaries, not merely copy headers into a new syntax. HTTP/2 can describe an unambiguous message while a downgraded HTTP/1 representation introduces a different endpoint for its body.

Research anchor and scope

James Kettle’s HTTP/2 research demonstrates H2.CL and H2.TE disagreements at downgrade boundaries. The cases include a forwarded incorrect content length and a forbidden transfer-encoding field surviving translation. The reported service vulnerabilities were patched. These are architectural attack classes, not evidence that current installations of the named services remain vulnerable; establish the deployed translation behavior independently.

Draw the two parsers

For the front end, record the total DATA payload and stream completion. For the back end, record the synthesized request line and headers plus the exact transmitted body bytes. Ask which bytes each side thinks belong to request A. If the back end stops before the front end’s body ends, leftover bytes may be interpreted as request B on a persistent connection.

A toy byte ledger has front-end body length 12 and forwarded content length 4. Bytes 0–3 belong to A in both interpretations; bytes 4–11 remain A’s body for the front end but fall after A for the back end. Whether those bytes become a useful request depends on their syntax and the lifetime of the reused connection. An invalid length alone may simply cause rejection.

Confirm without overclaiming

Use a controlled pair of endpoints with distinguishable responses. Compare an unambiguous baseline, the suspected translation mismatch, and a same-connection follow-up. Record ordering and repeat on a fresh connection. A timeout is a detection clue, not conclusive evidence: buffering, content-length validation, and upstream timeouts can all produce delays.

Prefer capturing the downgraded bytes in a local replica when possible. Tool displays often render HTTP/2 as text even though the wire protocol uses frames and compressed header blocks. A displayed newline is not necessarily the same byte sequence sent to the server. Keep protocol negotiation, translation, and connection reuse visible in the experiment.

Primitive boundaries

A request-boundary disagreement can yield a prefix on a subsequent request, an isolated tunneled request, or an extra back-end response. These have different impact. Cross-user interference additionally requires back-end connection sharing or another routing condition; a connection dedicated to the attacker does not automatically affect victims.

End-to-end HTTP/2 removes this particular downgrade boundary, but application and proxy parsing behavior still needs review. Header validation, synchronized framing rules, and closing connections after malformed input matter at the actual deployment. Retain a byte-level explanation of the primitive instead of classifying a response anomaly from a scanner label alone.