sqlmapproject/sqlmap · error · H2Error

request header list exceeds peer-advertised limit

Error message

request header list exceeds peer-advertised limit

What it means

Pre-send capacity check in _send_headers: the serialized request header block (after splitting into HEADER/CONTINUATION frames sized to SETTINGS_MAX_FRAME_SIZE) exceeds the peer's advertised SETTINGS_MAX_HEADER_LIST_SIZE. It is a client-side guard against a server-side limit, fired before any frames go on the wire.

Solutions

1. Reduce request header count/size (drop cookies, long URLs, custom headers)
2. Ask the server operator to raise max header list size
3. Split the work across requests with smaller header sets

When it happens

Trigger: Thrown at lib/request/http2.py:1068 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/d745edc1780eaf2f. Report an issue: GitHub.

Appendix: source

Thrown at lib/request/http2.py:1068

            self._connection_error("WINDOW_UPDATE referenced an idle stream")

    def _allocate_stream_ids(self, count):
        if count <= 0:
            raise ValueError("stream count must be positive")
        last = self.next_sid + 2 * (count - 1)
        if last > MAX_STREAM_ID:
            self.usable = False
            raise H2Error("HTTP/2 stream-id space exhausted")
        sids = [self.next_sid + 2 * index for index in range(count)]
        self.next_sid += 2 * count
        if self.next_sid > MAX_STREAM_ID:
            self.usable = False
        return sids

    def _send_headers(self, sid, request_headers, end_stream):
        if self.peer_max_header_list_size is not None:
            if _field_section_size(request_headers) > self.peer_max_header_list_size:
                raise H2Error("request header list exceeds peer-advertised limit")
        block = Encoder().encode(request_headers)
        return b"".join(_header_frames(sid, block, self.peer_max_frame_size, end_stream))

    def _finish_response(self, state):
        actual = len(state.body)
        if state.body_forbidden and actual:
            self._connection_error("response semantics forbid a message body")
        if (not state.body_forbidden and state.expected_content_length is not None and
                actual != state.expected_content_length):
            self._connection_error(
                "response content-length mismatch (expected %d, received %d)" %
                (state.expected_content_length, actual)
            )
        state.complete = True

    def _complete_header_block(self, state):
        try:
            headers = self.dec.decode(bytes(state.block))

View on GitHub (pinned to 0a35b20e39)