{
  "same_root_cause": true,
  "root_cause_sink": "Tstrcmp prefix match in bin/vinyld/http2/cache_http2_hpack.c:h2h_addhdr()",
  "root_cause_description": "The Tstrcmp macro in include/vdef.h only compares the first Tlen(t) bytes of the literal string, so any HPACK pseudo-header name that is a prefix of :method, :path, :scheme, or :authority is accepted as that pseudo-header. The :authority branch then performs memcpy(d->out + 6, \"host\", 4) and hdr.b += 6; for a short prefix like :a the resulting header is zero-length and serializes as a bare \\r\\n to the HTTP/1 backend, enabling request smuggling.",
  "evidence": "All tested variants rely on a pseudo-header name that is a prefix of one of the four standard pseudo-headers. Only :a (the shortest prefix of :authority that does not also match :method, :path, or :scheme) produces a zero-length header and the observed backend desync. The fixed version uses Tstreq, which requires both equal length and equal content, so every prefix variant is rejected.",
  "tested_variants": [
    {
      "header": ":a",
      "prefix_of": ":authority",
      "vuln_smuggle": true,
      "fixed_blocked": true
    },
    {
      "header": ":",
      "prefix_of": ":method (and others)",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":au",
      "prefix_of": ":authority",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":auth",
      "prefix_of": ":authority",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":m",
      "prefix_of": ":method",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":p",
      "prefix_of": ":path",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":s",
      "prefix_of": ":scheme",
      "vuln_smuggle": false,
      "fixed_blocked": true
    },
    {
      "header": ":authorityfoo",
      "prefix_of": "none",
      "vuln_smuggle": false,
      "fixed_blocked": true
    }
  ]
}