> Source: [sk1000292](https://support.checkpoint.com/results/sk/sk1000292)

# sk1000292 - Websites that return large HTTP/2 response headers do not load when HTTPS Inspection is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk1000292 |
| Date Created | 2026-10-19 |
| Last Modified | 2026-11-12 |
| Technical Level | General |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Gaia |

## Symptoms

- * Websites that return large HTTP/2 response headers do not load, when HTTPS Inspection is enabled. The issue was reproduced with websites that return large HTTP/2 response headers, such as gemini.google.com, chatgpt.com, and claude.ai.

* The Check Point Firewall stops forwarding the affected connections without displaying a block page or a reset message in the browser.

*
  The Check Point Firewall debug logs also show "
  *COMPRESSION_ERROR*
  " messages and indicate that the connection is closed.


  Kernel debug errors (`fw
  ctl debug -m WS + all`):

  ```
  ws_http2_parse_frame: [ERROR]: Expected frame of type CONTINUATION and stream id 1 but got a frame of type DATA and stream id 1;
  ws_http2_parse_frame: [ERROR]: Expected frame_type is not matched to current frame_type;
  ws_http2_handle_parser_action: error code is COMPRESSION_ERROR;
  ws_http2_handle_error_codes: got a connection error, by stream id 1. Connection will be closed.
    
  ```

## Cause

During HTTPS Inspection, the Check Point Firewall parses HTTP/2 response headers. HTTPS Inspection decrypts TLS traffic so that the Check Point Firewall can inspect it.

When a server response contains headers that are too large for one HTTP/2 `HEADERS` frame, the Check Point Firewall correctly expects one or more HTTP/2 `CONTINUATION` frames. After the Check Point Firewall receives the complete header block and forwards it to the client, an internal condition on the Check Point Firewall incorrectly continues to indicate that the next frame must be a `CONTINUATION` frame.

As a result, the Check Point Firewall incorrectly treats the next valid HTTP/2 `DATA` frame as a protocol violation. The HTTP/2 parser generates errors, including *COMPRESSION_ERROR*, and the Check Point Firewall stops forwarding the affected connection.

As a result, affected websites with large HTTP/2 response headers remain in a continuous loading state when HTTPS Inspection inspects the traffic.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 52
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 132
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 174

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content