Skip to content

Pull requests: apache/pekko-http

New pull request New
36 Open 1,079 Closed
36 Open 1,079 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

fix: drop rendered headers containing NUL as well as CR and LF (#1260)
#1272 opened Sep 3, 2026 by pjfanning Member Loading… 1.4.1
fix: drop HTTP/2 header fields containing CR, LF or NUL (#1258)
#1271 opened Sep 3, 2026 by pjfanning Member Loading… 1.4.1
fix: prevent CRLF injection through chunk trailers and extensions (#1256)
#1270 opened Sep 3, 2026 by pjfanning Member Loading… 1.4.1
Compare path elements when checking that a served file is below the base directory (#1218)
#1269 opened Sep 3, 2026 by pjfanning Member Loading… 1.4.1
fix: count repeated Connection headers towards max-header-count (#1255)
#1268 opened Sep 3, 2026 by pjfanning Member Loading… 1.4.1
fix: reject a message whose Transfer-Encoding value cannot be parsed
#1267 opened Aug 31, 2026 by pjfanning Member Loading…
feat: bound the number of parts in a multipart entity
#1266 opened Aug 31, 2026 by pjfanning Member Loading…
feat: allow empty HTTP/2 DATA frames to be throttled
#1265 opened Aug 31, 2026 by pjfanning Member Loading…
feat: bound the size of an incoming HTTP/2 frame
#1264 opened Aug 31, 2026 by pjfanning Member Loading…
docs: warn that getFromResource does not filter its resource name
#1263 opened Aug 31, 2026 by pjfanning Member Loading…
fix: require every Origin to be allowed on a CORS request
#1262 opened Aug 31, 2026 by pjfanning Member Loading…
fix: ignore the reserved bit of an incoming HTTP/2 stream identifier
#1261 opened Aug 31, 2026 by pjfanning Member Loading…
fix: release connection-level flow control accounting for discarded buffered data
#1259 opened Aug 31, 2026 by pjfanning Member Loading…
fix: reject whitespace between chunk-size digits
#1257 opened Aug 31, 2026 by pjfanning Member Loading…
docs: modernize HTTP/2 ALPN and h2c guidance
#1253 opened Aug 30, 2026 by samueleresca Member Loading…
4
fix: keep the HPACK decoder usable after a header fails to parse
#1252 opened Aug 30, 2026 by pjfanning Member Loading…
hpack: decode header blocks from any InputStream, without copying
#1251 opened Aug 30, 2026 by pjfanning Member Loading…
http/2: prototype ALPN fallback from HTTP/2 to HTTP/1.1 for client connections
#1250 opened Aug 30, 2026 by pjfanning Member • Draft
give ParsingErrorHandler access to the request that was rejected
#1246 opened Aug 27, 2026 by pjfanning Member Loading…
1
Add a draft threat model and wire it for discoverability
#1242 opened Aug 27, 2026 by potiuk Member Loading…
4
perf: avoid copying WebSocket deflate/inflate output
#1235 opened Aug 25, 2026 by pjfanning Member Loading…
1
feat: optional strict response entities for the HTTP client
#1233 opened Aug 25, 2026 by pjfanning Member • Draft
2
perf: decode parser byte ranges in bulk instead of char by char
#1229 opened Aug 24, 2026 by pjfanning Member Loading…
perf: hand ByteBuffers to Inflater and CRC32 in the coding stages
#1228 opened Aug 24, 2026 by pjfanning Member Loading…
add warnings about limitations of idle-timeout
#1194 opened Jul 29, 2026 by pjfanning Member Loading…
2
ProTip! Adding no:label will show everything without a label.