OpenBMC bmcweb HTTP/2 body buffering (HttpBody::reader, nghttp2 flow control): The HTTP/2 code path in bmcweb appends

Impact

The HTTP/2 code path in bmcweb appends incoming DATA frames with no size check at all, and nghttp2's default window auto-replenishment means the data flows before authentication happens. Same outcome as the Expect bug but worse, because it bypasses the body limit entirely rather than merely leaking past it, and because h2 is negotiated by default over ALPN so it is the path a modern client takes automatically. The researcher rates it the most severe of the four findings. Reported as unfixed on master at time of disclosure, with no advisory and no CVE - so this is a known, public, unpatched pre-auth DoS in the daemon that owns every out-of-band control path on your fleet.

Who can reach it

Unauthenticated HTTP/2 over TLS to bmcweb on the management interface. ALPN negotiates h2 by default, so no unusual client is needed.

What to do

No fix as of disclosure; proposed Gerrit patches were posted to the OpenBMC mailing list. This is a config-only situation until upstream lands a fix and your ODM rebases - so ACL the BMC HTTPS port to management jump hosts only, and if your tooling can live on HTTP/1.1, disabling h2 in ALPN on the BMC removes the path. Assume no firmware you can buy today contains a fix. When one exists it arrives as a per-node out-of-band BMC firmware flash with the usual ODM lag.

References