sqlmapproject/sqlmap · error · H2ProtocolError

invalid response pseudo-field ordering or duplication

Error message

invalid response pseudo-field ordering or duplication

What it means

Guard inside _validate_response_field_section rejecting response pseudo-fields that appear out of order, are duplicated, appear in trailers, or are anything other than :status. HTTP/2 mandates that :status be the sole pseudo-field, appear first, and occur exactly once in a response header section; the offending input is the pseudo-field name/value at fault.

Solutions

1. Drop the connection: this is a framing-level protocol violation by the server
2. Verify no intermediary (proxy/CDN) is mangling the response into invalid HTTP/2
3. If emulating the server side, emit :status exactly once before regular fields

When it happens

Trigger: Thrown at lib/request/http2.py:865 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/b58154954b37865b. Report an issue: GitHub.

Appendix: source

Thrown at lib/request/http2.py:865

            values.append(int(part))
    if not values:
        return None
    expected = values[0]
    if any(value != expected for value in values[1:]):
        raise H2ProtocolError("conflicting content-length fields")
    return expected


def _validate_response_field_section(headers, trailers=False):
    regular_seen = False
    status = None
    for name, value in headers:
        name = _as_bytes(name)
        value = _as_bytes(value)
        _validate_field_value(value)
        if name.startswith(b":"):
            if trailers or regular_seen or name != b":status" or status is not None:
                raise H2ProtocolError("invalid response pseudo-field ordering or duplication")
            if len(value) != 3 or not value.isdigit():
                raise H2ProtocolError("invalid :status pseudo-field")
            status = int(value)
            if not 100 <= status <= 599:
                raise H2ProtocolError("response status is outside the valid range")
            if status == 101:
                raise H2ProtocolError("101 Switching Protocols is not valid in HTTP/2")
        else:
            regular_seen = True
            if name.lower() != name:
                raise H2ProtocolError("uppercase HTTP/2 field name")
            _validate_regular_name(name)
            if name in _CONNECTION_FIELDS:
                raise H2ProtocolError("connection-specific field in HTTP/2 response")
    content_length = _parse_content_length(headers, trailers=trailers)
    if trailers:
        return None, None
    if status is None:

View on GitHub (pinned to 0a35b20e39)