1 matches found
curl: 10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections
Summary CURLOPTMAXLIFETIMECONN is not enforced when a new transfer is attached to an active multiplexed HTTP/2 connection. The connection-age eligibility check in urlmatchconn is gated behind !CONNINUSEconn, so an in-use HTTP/2 connection with spare stream capacity is accepted without any age...
5.9AI score
SaveExploits0
20