From decc6090851236ec6b09ce79433283867d4d9746 Mon Sep 17 00:00:00 2001
From: Ramesh Adhikari <adhikari.resume@gmail.com>
Date: Thu, 30 Jul 2026 21:59:16 +0530
Subject: [PATCH] h3-proxy: fix NULL deref when non-:status header arrives
 before :status

Closes #22449
---
 lib/vquic/cf-ngtcp2-proxy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vquic/cf-ngtcp2-proxy.c b/lib/vquic/cf-ngtcp2-proxy.c
index ec6de93368..f5c967c5b1 100644
--- a/lib/vquic/cf-ngtcp2-proxy.c
+++ b/lib/vquic/cf-ngtcp2-proxy.c
@@ -431,6 +431,9 @@ static int cb_h3_proxy_recv_header(nghttp3_conn *conn, int64_t stream_id,
     pctx->tunnel.resp = resp;
   }
   else {
+    if(!pctx->tunnel.resp) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
     /* store as an HTTP1-style header */
     CURL_TRC_CF(data, cf, "[%" PRId64 "] header: %.*s: %.*s", stream_id,
                 (int)h3name.len, h3name.base, (int)h3val.len, h3val.base);
-- 
2.47.3