{"record":{"id":"b58154954b37865b","repo":"sqlmapproject/sqlmap","slug":"invalid-response-pseudo-field-ordering-or-duplicat","errorCode":null,"errorMessage":"invalid response pseudo-field ordering or duplication","messagePattern":"invalid response pseudo-field ordering or duplication","errorType":"exception","errorClass":"H2ProtocolError","httpStatus":null,"severity":"error","filePath":"lib/request/http2.py","lineNumber":865,"sourceCode":"            values.append(int(part))\n    if not values:\n        return None\n    expected = values[0]\n    if any(value != expected for value in values[1:]):\n        raise H2ProtocolError(\"conflicting content-length fields\")\n    return expected\n\n\ndef _validate_response_field_section(headers, trailers=False):\n    regular_seen = False\n    status = None\n    for name, value in headers:\n        name = _as_bytes(name)\n        value = _as_bytes(value)\n        _validate_field_value(value)\n        if name.startswith(b\":\"):\n            if trailers or regular_seen or name != b\":status\" or status is not None:\n                raise H2ProtocolError(\"invalid response pseudo-field ordering or duplication\")\n            if len(value) != 3 or not value.isdigit():\n                raise H2ProtocolError(\"invalid :status pseudo-field\")\n            status = int(value)\n            if not 100 <= status <= 599:\n                raise H2ProtocolError(\"response status is outside the valid range\")\n            if status == 101:\n                raise H2ProtocolError(\"101 Switching Protocols is not valid in HTTP/2\")\n        else:\n            regular_seen = True\n            if name.lower() != name:\n                raise H2ProtocolError(\"uppercase HTTP/2 field name\")\n            _validate_regular_name(name)\n            if name in _CONNECTION_FIELDS:\n                raise H2ProtocolError(\"connection-specific field in HTTP/2 response\")\n    content_length = _parse_content_length(headers, trailers=trailers)\n    if trailers:\n        return None, None\n    if status is None:","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/request/http2.py#L847-L883","documentation":"Guard inside _validate_response_field_section rejecting response pseudo-fields that appear out of order, are duplicated, appear in trailers, or are anything other than :status. HTTP/2 mandates that :status be the sole pseudo-field, appear first, and occur exactly once in a response header section; the offending input is the pseudo-field name/value at fault.","triggerScenarios":"Thrown at lib/request/http2.py:865 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Drop the connection: this is a framing-level protocol violation by the server","Verify no intermediary (proxy/CDN) is mangling the response into invalid HTTP/2","If emulating the server side, emit :status exactly once before regular fields"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}