| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-30 | 1.5 kB | |
| v2.13.5 source code.tar.gz | 2026-10-30 | 609.6 kB | |
| v2.13.5 source code.zip | 2026-10-30 | 683.2 kB | |
| Totals: 3 Items | 1.3 MB | 0 | |
HTTP v2.13.5
Fixed
- The HTTP/2 server now counts the streams it resets because of a client's frames, such as a body that contradicts its
Content-Length, toward the same limit as RST_STREAM frames sent by the client, and sends GOAWAY(ENHANCE_YOUR_CALM) past it. Before, a client could make it reset streams on one connection without limit (CVE-2025-8671). (#1544) - With
read_header_timeoutset, the HTTP/2 server now applies it to a whole header block. It used to restart the timeout for each CONTINUATION frame, so a client sending them slowly could keep a block open far longer. (#1543) - The HTTP/2 server now follows the RFC 9113 stream-state rules. RST_STREAM or WINDOW_UPDATE for a stream the client never opened, and any PUSH_PROMISE from a client, end the connection with PROTOCOL_ERROR; these frames used to be ignored. A WINDOW_UPDATE that takes one stream's send window over 2^31 - 1 now resets only that stream, and flow-control violations use FLOW_CONTROL_ERROR. (#1542)
See CHANGELOG.md for details.
(Release notes generated via AI.)
Merged pull requests:
- Follow RFC 9113 stream-state rules in the HTTP/2 server (#1542) (@quinnj-bot[bot])
- Apply read_header_timeout to a whole HTTP/2 header block (#1543) (@quinnj-bot[bot])
- Count server-forced HTTP/2 stream resets toward the Rapid-Reset budget (#1544) (@quinnj-bot[bot])
- Release HTTP 2.13.5 (#1545) (@quinnj-bot[bot])
