IT41620: INBOUND HTTP REQUEST URLS OR QUERY STRINGS MAY BE CORRUPTED IF HTTP REQUEST LINE EXCEEDS 4096 BYTES

APAR status

• Closed as program error.

Error description

• If an HTTP request is sent to the embedded or node-wide HTTP
  listener, and ther request has a HTTP request line which exceeds
  4096 bytes, then the request URL or query string may be
  corrupted. This can manifest in a number of different ways:
  
  * The request may be sent to the wrong path, or rejected due to
  no matching path being found
  * The X-Query-String input header will not match what was sent
  by the client
  * If the "Parse Query String" option is selected, then the
  resulting tree structure in the LocalEnvironment may be missing
  elements or have incorrect elemenst
  * If the "Parse Query String" option is selected, then an
  exception may be thrown inside the HTTPInput node stating that
  the query string contains unconvertible characters
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of inbound HTTP or HTTPS connections in IBM App
  Connect Enterprise
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  <div><div>If an HTTP request is sent to the embedded or
  node-wide HTTP listener, and their request has a HTTP request
  line which exceeds 4096 bytes, then the request URL or query
  string may be corrupted. This can manifest in a number of
  different ways:</div> <div>* The request may be sent to the
  wrong path, or rejected due to no matching path being
  found</div><div>* The X-Query-String input header will not match
  what was sent by the client</div><div>* If the "Parse Query
  String" option is selected, then the resulting tree structure in
  the LocalEnvironment may be missing elements or have incorrect
  elemenst</div><div>* If the "Parse Query String" option is
  selected, then an exception may be thrown inside the HTTPInput
  node stating that the query string contains unconvertible
  characters</div></div>
  

Problem conclusion

• Long HTTP request lines are now correctly processed up to the
  MaxHeaderSize. Request lines that exceed the MaxHeaderSize will
  be rejected.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.20
  v12.0      12.0.7.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels