For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_Bowman's avatar
Dan_Bowman
Icon for Cirrus rankCirrus
Dec 22, 2017

Problem with HTTP2 profiles on 13.1.0.1?

Before I open a support case, just wondering if anyone else has experienced an issue with the latest update and VS that use HTTP2 profiles?   Specifically seems to impact Firefox users who just ge...
application delivery
BIG-IP
http2
Nav_126513's avatar
Nav_126513
Icon for Nimbostratus rankNimbostratus
Feb 22, 2018

13.1.0.3 has been released yesterday. In the list of known issues in the release notes:

703191-2 2-Critical HTTP2 requests may contain invalid headers when sent to servers

Details of the issue in the release notes:

703191-2 : HTTP2 requests may contain invalid headers when sent to servers

Component: Local Traffic Manager

Symptoms:
HTTP requests handled by an HTTP/2 virtual server may have blank header names when proxied through to the server or when handled via iRules.

Conditions:
-- Virtual server has the HTTP/2 profile assigned.
-- Client and the BIG-IP system negotiate/use HTTP/2.

Impact:
HTTP/2 applications may generate CSRF-related errors. Alternately, the server may return intermittent (and from the client's perspective, spurious) 400 Bad Request responses.

Workaround:
There is no workaround other than to remove the HTTP/2 profile from the virtual server.