Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1

How it was found

When curl send a request with Transfer-Encoding: chunked using HTTP/1.1, and follows a redirect to an HTTP/2 endpoint, the upload_chunky flag is not properly reset. As a result, the Transfer-Encoding: chunked header is sent in the subsequent request even when HTTP/2 is negotiated/used.

This violates RFC 9113 (HTTP/2) which states that HTTP/2 uses its own farming and Transfer-Encoding header must not be used.

Proof OF Concept

Setup: Local test server with HTTP/1.1 ---> HTTPS (HTTP/2) redirect Reproduction Command:

curl -vvv --http1.1 --no-alpn -L --http2 -k \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: text/plain" \
  -d "This is chunked encoding bug test data" \
  http://test.local:8080/

Observed Behavior:

• First request (HTTP/1.1): Transfer-Encoding: chunked --> Correct
• Second request (after redirect): 'Transfer-Encoding: chunked' is still present ---> Vulnerable Even with --http2 flag, the header is not suppressed.

Root Cause

in 'lib/http.c'

• http_req_set_TE() and 'http_add_content_hds()' functions only check HTTP version at intial request setup.
• During redirect handling ('Curl_follow_Location()' / new Request setup), the 'data->req.upload_chunky' falg is not relible reset when protocol changes from HTTP/1.1 ---> HTTP/2.

Impact

• Protocol confusion between client and server / proxies.
• potential for HTTP Request Smuggling / Desync attack in enviroments with reverse proxies or CDNs that handle HTTP/1.1 <--> HTTP/2 translation.
• Unexpected behavior in middleboxes and caching systems.