sqlmapproject/sqlmap · error · H2ProtocolError

invalid or conflicting content-length fields

Error message

invalid or conflicting content-length fields

What it means

Raised in _normalize_request_headers after collecting all content-length header values from the outgoing request: either the values conflict (more than one distinct value was seen across duplicate/multi-valued content-length headers) or the single value collected is not a pure ASCII digit string. It fires before the request is serialized, guarding the peer against ambiguous framing.

Solutions

1. Send exactly one valid numeric content-length header
2. Let the client compute content-length from the body

When it happens

Trigger: Thrown at lib/request/http2.py:742 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/9493db5e26c7f1c0. Report an issue: GitHub.

Appendix: source

Thrown at lib/request/http2.py:742

    content_lengths = []
    content_length_added = False
    for name, value in raw_items:
        if name == b"host" or name == b"proxy-authorization":
            continue
        if name in _CONNECTION_FIELDS or name in connection_tokens:
            continue
        if name == b"te" and value.strip().lower() != b"trailers":
            raise H2ProtocolError("HTTP/2 permits TE only with value 'trailers'")
        if name == b"content-length":
            content_lengths.append(value.strip())
            if content_length_added:
                continue
            content_length_added = True
        normalized.append((name, value))

    if content_lengths:
        if len(set(content_lengths)) != 1 or not content_lengths[0].isdigit():
            raise H2ProtocolError("invalid or conflicting content-length fields")
        expected = len(body)
        if int(content_lengths[0]) != expected:
            raise H2ProtocolError("content-length does not match request body")
    return normalized


def _request_header_list(method, path, authority, headers, body):
    method = _as_bytes(method)
    authority = _as_bytes(authority)
    path = _as_bytes(path)
    _validate_method(method)
    if not authority:
        raise H2ProtocolError("authority is required")
    _validate_pseudo_value(":authority", authority)
    if method == b"CONNECT":
        request = [(b":method", method), (b":authority", authority)]
    else:
        if not path:

View on GitHub (pinned to 0a35b20e39)