Netflix/zuul · error · URISyntaxException

Invalid host

Error message

Invalid host

What it means

parseHostHeader validates the Host header of an inbound request. It first tries strict RFC2396 parsing via java.net.URI; if that fails (e.g. underscores in the hostname, malformed port) and the STRICT_HOST_HEADER_VALIDATION flag is enabled, it throws a URISyntaxException with 'Invalid host'. The input at fault is the raw Host header value, which is not a valid RFC2396 authority.

Solutions

1. Fix the Host header sent by the client so it is a valid RFC2396 host[:port] (no underscores, bracketed IPv6, valid port)
2. Disable strict validation via the STRICT_HOST_HEADER_VALIDATION flag so Zuul falls back to the lenient colon-split parsing path
3. If you control a proxy in front of Zuul, sanitize or rewrite malformed Host headers before forwarding

When it happens

Trigger: Thrown at zuul-core/src/main/java/com/netflix/zuul/message/http/HttpRequestMessageImpl.java:597 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Netflix/zuul@14bf53c52d (2026-09-07). Data as JSON: /api/errors/1da8c27bb1048ab7. Report an issue: GitHub.

Appendix: source

Thrown at zuul-core/src/main/java/com/netflix/zuul/message/http/HttpRequestMessageImpl.java:597

    private static Pair<String, Integer> parseHostHeader(Headers headers) throws URISyntaxException {
        String host = headers.getFirst(HttpHeaderNames.HOST);
        if (host == null) {
            return new Pair<>(null, -1);
        }

        try {
            // attempt to use default URI parsing - this can fail when not strictly following RFC2396,
            // for example, having underscores in host names will fail parsing
            URI uri = new URI(/* scheme= */ null, host, /* path= */ null, /* query= */ null, /* fragment= */ null);
            if (uri.getHost() != null) {
                return new Pair<>(uri.getHost(), uri.getPort());
            }
        } catch (URISyntaxException e) {
            LOG.debug("URI parsing failed", e);
        }

        if (STRICT_HOST_HEADER_VALIDATION.get()) {
            throw new URISyntaxException(host, "Invalid host");
        }

        // fallback to using a colon split
        // valid IPv6 addresses would have been handled already so any colon is safely assumed a port separator
        String[] components = host.split(":", -1);
        if (components.length > 2) {
            // handle case with unbracketed IPv6 addresses
            return new Pair<>(null, -1);
        }

        String parsedHost = components[0];
        int parsedPort = -1;
        if (components.length > 1) {
            try {
                parsedPort = Integer.parseInt(components[1]);
            } catch (NumberFormatException e) {
                // ignore failing to parse port numbers and fallback to default port
                LOG.debug("Parsing of host port component failed", e);

View on GitHub (pinned to 14bf53c52d)