Invalid Scheme was Not Handled by H2O
Author: hQian2718Created Mar 29, 2026Updated Mar 30, 2026
I have been running some tests for the h2o server, and found that it doesn't reject an invalid scheme 1abc in the request uri.
Affected Version:
h2o version 2.3.0-DEV@725e54bc9
OpenSSL: OpenSSL 3.0.2 15 Mar 2022
mruby: YESh2o Conf:
user: root
hosts:
"default":
strict-match: ON
listen:
port: 80
paths:
"/":
file.dir: /usr/share/h2o/htdocsRequest Sent:
printf 'GET 1abc:/case/file.txt HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' | nc -v -w 5 localhost 8080returns a 404 instead of a 400.
Connection to localhost (127.0.0.1) 8080 port [tcp/http-alt] succeeded!
HTTP/1.1 404 File Not Found
Connection: close
Content-Length: 9
Server: h2o/2.3.0-DEV@725e54bc9
content-type: text/plain; charset=utf-8RFC reference:
Per the grammar in RFC 3986 3.1, the scheme must start with a letter.
scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
Source: h2o/h2o