From 47d3100b252dc6668a9e46ae885242be9eeca9cd Mon Sep 17 00:00:00 2001
From: Stefan Eissing <icing@apache.org>
Date: Wed, 27 May 2026 09:37:31 +0000
Subject: [PATCH]   *) mod_http2: update to version 2.0.41      Fix cookie
 header accounting against LimitRequestFields.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934678 13f79535-47bb-0310-9956-ffa450edef68

Conflict:context adapte,version file note merged
Reference:https://github.com/apache/httpd/commit/47d3100b252d.patch
---
 changes-entries/h2_v2.0.41.txt | 3 +++
 modules/http2/h2_util.c        | 4 ++++
 2 files changed, 7 insertions(+)
 create mode 100644 changes-entries/h2_v2.0.41.txt

diff --git a/changes-entries/h2_v2.0.41.txt b/changes-entries/h2_v2.0.41.txt
new file mode 100644
index 0000000..4d7df59
--- /dev/null
+++ b/changes-entries/h2_v2.0.41.txt
@@ -0,0 +1,3 @@
+  *) mod_http2: update to version 2.0.41
+     Fix cookie header accounting against LimitRequestFields.
+     [Stefan Eissing]
diff --git a/modules/http2/h2_util.c b/modules/http2/h2_util.c
index 8e53ceb..7182de6 100644
--- a/modules/http2/h2_util.c
+++ b/modules/http2/h2_util.c
@@ -1709,6 +1709,8 @@ static apr_status_t req_add_header(apr_table_t *headers, apr_pool_t *pool,
              && !ap_cstr_casecmp("cookie", (const char *)nv->name)) {
         existing = apr_table_get(headers, "cookie");
         if (existing) {
+            if (!nv->valuelen)
+                return APR_SUCCESS;
             /* Cookie header come separately in HTTP/2, but need
              * to be merged by "; " (instead of default ", ")
              */
@@ -1722,6 +1724,8 @@ static apr_status_t req_add_header(apr_table_t *headers, apr_pool_t *pool,
             apr_table_setn(headers, "Cookie",
                            apr_psprintf(pool, "%s; %s", existing, hvalue));
+            /* Treat the merge as an "add" to not escape LimitRequestFields */
+            *pwas_added = 1;
             return APR_SUCCESS;
         }
     }
     else if (nv->namelen == sizeof("host")-1
-- 
2.43.0