Description: Reject empty absolute-form authority (VSV00018)
 .
 Backport runtime change unchanged; adapt the existing stable parser test.
 The rejected request closes its connection, so use a separate client.
Author: Nils Goroll <nils.goroll@uplex.de>
Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/5c016b070e1994fd8a430b45dac7dc3ee63f04d7
Bug: https://vinyl-cache.org/security/VSV00018.html
Forwarded: not-needed
Last-Update: 2026-10-23

--- a/bin/varnishd/http1/cache_http1_proto.c
+++ b/bin/varnishd/http1/cache_http1_proto.c
@@ -377,6 +377,10 @@
 		e = strchr(b, '/');
 		if (e == NULL)
 			e = hp->hd[HTTP_HDR_URL].e;
+		if (e == b) {
+			// rfc9110 4.2.1 4.2.2 reject empty host
+			return (400);
+		}
 		http_Unset(hp, H_Host);
 		http_PrintfHeader(hp, "Host: %.*s", (int)(e - b), b);
 		hp->hd[HTTP_HDR_URL].b = e;
--- a/bin/varnishtest/tests/r01255.vtc
+++ b/bin/varnishtest/tests/r01255.vtc
@@ -1,6 +1,6 @@
 varnishtest "Test RFC9112 3.2 compliance"
 
-server s1 -repeat 6 {
+server s1 -repeat 4 {
 	rxreq
 	txresp -hdr "Foo: 1"
 } -start
@@ -36,11 +36,12 @@
 
 	txreq -url http:///bar -hdr "host: another"
 	rxresp
-	expect resp.http.rxhost == ""
-	expect resp.http.url == /bar
+	expect resp.status == 400
+} -run
+
+client c2 {
 
 	txreq -url http:// -hdr "host: another"
 	rxresp
-	expect resp.http.rxhost == ""
-	expect resp.http.url == /
+	expect resp.status == 400
 } -run
