HPACK decoder accepts overlong integer encodings (RFC 7541 §5.1)

h2o's HPACK decoder accepts overlong varint encodings — e.g., encoding a value that fits in 5 bits using the 11-bit or 21-bit prefix form. RFC 7541 §5.1 says implementations MAY reject overlong encodings, and several other HPACK implementations (nghttp2, ls-hpack) reject them.

This is an informational compliance note. Overlong encodings are technically decodable but can be used to bypass header length limits or obscure header content.

Found through differential fuzzing of HPACK implementations (PathDiff).