RFC 9112, "HTTP/1.1", June 2022

Errata ID: 7633
Status: Rejected
Type: Technical
Publication Format(s) : TEXT, PDF, HTML
Reported By: Amos Jeffries
Date Reported: 2023-09-06
Rejected by: Francesca Palombini
Date Rejected: 2023-11-07

Section 2.2 says:

   Although the line terminator for the start-line and fields is the
   sequence CRLF, a recipient MAY recognize a single LF as a line
   terminator and ignore any preceding CR.

It should say:

   Although the line terminator for the start-line, fields, chunk
   and last-chunk is the sequence CRLF, a recipient MAY recognize
   a single LF as a line terminator and ignore any preceding CR.

Notes:

chunked encoding (section 6.3) uses CRLF for line/framing delimiters in the same manner as other HTTP message sections. But these lines are not listed as a possible sites of bare-LF line terminator. Which makes for an unnecessary parser exception and complicates possible request smuggling robustness between implementations.
--VERIFIER NOTES--
The difference was intentional. A chunked parser is not a start line or field parser (it is a message body parser) and it is supposed to be less forgiving because it does not have to retain backwards compatibility with 1.0 parsers.

Hence, bare LF around the chunk sizes would be invalid and should result in the connection being marked as invalid.

In any case, suggestions to further hardening of the chunked parser would have to be defined in that section, and would need to be achieved through a consensus document, not in an errata report.

Report New Errata