{"record":{"id":"0e7dd3ceeee09ac0","repo":"projectdiscovery/nuclei","slug":"could-not-rebuild-request-url","errorCode":null,"errorMessage":"could not rebuild request URL","messagePattern":"could not rebuild request URL","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/http/httpclientpool/errors.go","lineNumber":6,"sourceCode":"package httpclientpool\n\nimport \"errors\"\n\nvar (\n\tErrRebuildURL = errors.New(\"could not rebuild request URL\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":8,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/http/httpclientpool/errors.go#L1-L8","documentation":"Sentinel error from the shared HTTP client pool. It is returned (wrapped together with the underlying parse error) by checkMaxRedirects: while following a redirect, if the new request URL is not already URL-encoded, nuclei re-parses it with urlutil.Parse (fix for issue #5900); a parse failure aborts the redirect chain with ErrRebuildURL. So the real cause is a redirect Location (or original URL) that Go's URL parser cannot handle.","triggerScenarios":"A target server redirects to a Location header containing unparseable content — raw spaces, invalid percent-encoding (e.g. '%' not followed by hex), malformed IPv6 literal — or a proxy rewrites Location into something invalid. Nuclei then fails that request with this wrapped error.","commonSituations":"Misconfigured redirectors and short-link services emitting unencoded URLs; WAFs/proxies mangling Location headers; legacy apps with spaces in paths.","solutions":["Inspect the wrapped error chain — errors.Is(err, httpclientpool.ErrRebuildURL) plus the inner parse error names the bad URL","If you control the server/redirector, percent-encode the Location URL properly","Otherwise exclude or manually investigate the offending target; the failure is server-side data, not a nuclei bug","Keep nuclei updated: URL-rebuild handling in redirects has been progressively hardened"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if u, err := urlutil.Parse(targetURL); err != nil {\n    // unparseable URL will fail earlier anyway; skip before scanning\n    return fmt.Errorf(\"skipping target with unparseable URL: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := doRequest(); err != nil {\n    if errors.Is(err, httpclientpool.ErrRebuildURL) {\n        // server emitted an unparseable redirect URL — log and skip this target\n        gologger.Warning().Msgf(\"bad redirect URL on %s: %v\", target, err)\n        return nil\n    }\n    return err\n}","preventionTips":["Check Location headers of redirect-heavy targets with curl -I during recon","Percent-encode URLs you control (spaces, %) before redirecting to them","Handle this as a per-target skip, not a scan abort"],"tags":["http","redirect","url-parsing","client"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}