sqlmapproject/sqlmap · error · H2ProtocolError

callers may not inject HTTP/2 pseudo-fields

Error message

callers may not inject HTTP/2 pseudo-fields

What it means

_normalize_request_headers guard: a caller-supplied header name starts with ':', attempting to inject HTTP/2 pseudo-fields (:method, :path, ...) from the user header list; pseudo-fields are synthesized exclusively by the client, so this is refused to prevent request smuggling.

Solutions

  1. Remove ':'-prefixed names from user headers
  2. Express the intent via method/path/authority arguments instead
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at lib/request/http2.py:712 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/f09d33a4cf2ad958. Report an issue: GitHub.

Appendix: source

Thrown at lib/request/http2.py:712

            raise H2ProtocolError("invalid octet in %s pseudo-field" % name)


def _validate_method(method):
    if not method:
        raise H2ProtocolError("method is required")
    for item in bytearray(method):
        if item not in _METHOD_TOKEN_BYTES:
            raise H2ProtocolError("invalid HTTP method token")


def _normalize_request_headers(headers, body):
    raw_items = []
    connection_tokens = set()
    for key, value in _iter_header_items(headers):
        name = _as_bytes(key).lower()
        val = _as_bytes(value)
        if name.startswith(b":"):
            raise H2ProtocolError("callers may not inject HTTP/2 pseudo-fields")
        _validate_regular_name(name)
        _validate_field_value(val)
        raw_items.append((name, val))
        if name == b"connection":
            for token in val.split(b","):
                token = token.strip().lower()
                if token:
                    _validate_regular_name(token)
                    connection_tokens.add(token)

    normalized = []
    content_lengths = []
    content_length_added = False
    for name, value in raw_items:
        if name == b"host" or name == b"proxy-authorization":
            continue
        if name in _CONNECTION_FIELDS or name in connection_tokens:
            continue

View on GitHub (pinned to 0a35b20e39)