actix/actix-web · error · io::Error

Invalid chunk size line: Size is too big

Error message

Invalid chunk size line: Size is too big

What it means

io::Error(InvalidInput, "Invalid chunk size line: Size is too big") (chunked.rs:81-84) is returned when read_size's checked_mul overflows u64 while accumulating hex digits — i.e. the declared chunk size is astronomically large (> 2^64). The unit test hrs_chunk_size_overflow (chunked.rs:407-426) reproduces it with 'f0000000000000003'.

Source

Thrown at actix-http/src/h1/chunked.rs:81

            b'\r' => return Poll::Ready(Ok(ChunkedState::SizeLf)),
            _ => {
                return Poll::Ready(Err(io::Error::new(
                    io::ErrorKind::InvalidInput,
                    "Invalid chunk size line: Invalid Size",
                )));
            }
        };

        match size.checked_mul(radix) {
            Some(n) => {
                *size = n;
                *size += rem as u64;

                Poll::Ready(Ok(ChunkedState::Size))
            }
            None => {
                debug!("chunk size would overflow u64");
                Poll::Ready(Err(io::Error::new(
                    io::ErrorKind::InvalidInput,
                    "Invalid chunk size line: Size is too big",
                )))
            }
        }
    }

    fn read_size_lws(rdr: &mut BytesMut) -> Poll<Result<ChunkedState, io::Error>> {
        match byte!(rdr) {
            // LWS can follow the chunk size, but no more digits can come
            b'\t' | b' ' => Poll::Ready(Ok(ChunkedState::SizeLws)),
            b';' => Poll::Ready(Ok(ChunkedState::Extension)),
            b'\r' => Poll::Ready(Ok(ChunkedState::SizeLf)),
            _ => Poll::Ready(Err(io::Error::new(
                io::ErrorKind::InvalidInput,
                "Invalid chunk size linear white space",
            ))),
        }

View on GitHub (pinned to 937960ca67)

Solutions

1. Reject the request at the edge; the peer is sending an impossible chunk size.
2. Configure payload size limits (PayloadConfig) so oversized bodies are rejected before this point where possible.
3. Ensure any reverse proxy normalises/validates Transfer-Encoding.

// Treat oversized/overflowing chunk sizes as a bad request.
use actix_http::error::PayloadError;
match payload.next().await {
    Some(Err(PayloadError::Io(e))) if e.kind() == io::ErrorKind::InvalidInput => {
        return HttpResponse::BadRequest().finish(); // likely malicious
    }
    _ => {}
}

When it happens

Trigger: A chunked body declares a size field whose hex value exceeds u64::MAX (e.g. 'f0000000000000003'). This is almost always a malicious or malformed payload intended to exhaust the parser.

Common situations: HTTP Request Smuggling / parser-stress fuzzing, or a corrupt size field from a broken encoder.

Related errors

• Invalid character in chunk extension
• Invalid chunk size line: Invalid Size
• Invalid chunk size linear white space
• Invalid chunk size LF
• Invalid chunk body CR

AI-assisted analysis of actix/actix-web@937960ca67 (2026-08-06). Data as JSON: /data/errors/000c1413b161d1e3.json. Report an issue: GitHub.