{"record":{"id":"154feb22b8e19814","repo":"valyala/fasthttp","slug":"invalid-headers-headers-cannot-start-with-space-o","errorCode":null,"errorMessage":"invalid headers, headers cannot start with space or tab","messagePattern":"invalid headers, headers cannot start with space or tab","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"headerscanner.go","lineNumber":52,"sourceCode":"\t\t\treturn false\n\t\t}\n\n\t\tif s.blockEnd >= 4 && s.blockEnd <= len(s.b) &&\n\t\t\tbytes.Equal(s.b[s.blockEnd-4:s.blockEnd], strCRLFCRLF) {\n\t\t\t// The caller already found the end of the block, no need to\n\t\t\t// search for it again. The first CRLFCRLF can only sit at\n\t\t\t// blockEnd-4 since readRawHeaders stops at the first blank line.\n\t\t\ts.b = s.b[:s.blockEnd]\n\t\t} else {\n\t\t\ti := bytes.Index(s.b, strCRLFCRLF)\n\t\t\tif i < 0 {\n\t\t\t\ts.err = ErrNeedMore\n\t\t\t\treturn false\n\t\t\t}\n\t\t\ts.b = s.b[:i+4]\n\t\t}\n\t\tif len(s.b) > 0 && (s.b[0] == ' ' || s.b[0] == '\\t') {\n\t\t\ts.err = errors.New(\"invalid headers, headers cannot start with space or tab\")\n\t\t\treturn false\n\t\t}\n\n\t\ts.initialized = true\n\t}\n\n\tkv, colon, err := s.readContinuedLineSlice()\n\tif len(kv) == 0 {\n\t\ts.err = err\n\t\treturn false\n\t}\n\n\t// Key ends at the first colon, already found by readContinuedLineSlice.\n\tk, v := kv[:colon], kv[colon+1:]\n\tvalid, innerSpace := isValidHeaderKey(k)\n\tif !valid {\n\t\ts.err = fmt.Errorf(\"malformed mime header line: %q\", kv)\n\t\treturn false","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/headerscanner.go#L34-L70","documentation":"The header scanner requires the first line of a header block to start a header name; if the buffer begins with a space or tab (an obsolete line fold with no preceding header), parsing fails with this error. next() raises it and it propagates through parseHeaders and parseTrailer.","triggerScenarios":"HeaderScanner.Next() on a header block whose first byte is ' ' or '\\t' — e.g. a request/response whose headers start with a continuation line, or trailer section beginning with folded whitespace.","commonSituations":"Broken clients/servers emitting malformed folded headers; corruption from a hand-rolled HTTP writer; fuzzed or malicious input probing the parser.","solutions":["Fix the sender so each header line starts with 'Name: value' with no leading whitespace.","If line folding is intentional, unfold headers before writing (join continuation lines into one).","Sanitize/validate raw bytes at the edge proxy before forwarding to fasthttp.","Update the client library — old versions of some HTTP stacks emitted obs-fold line endings."],"exampleFix":"// before\n\"Host: example.com\\r\\n\\r\\n  X: y\\r\\n\"\n// after\n\"Host: example.com\\r\\nX: y\\r\\n\"","handlingStrategy":"validation","validationCode":"func headersWellFormed(raw []byte) bool {\n    lines := strings.Split(string(raw), \"\\r\\n\")\n    for _, l := range lines {\n        if l == \"\" { break }\n        if l[0] == ' ' || l[0] == '\\t' { return false }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Write headers as 'Name: value' lines with no leading whitespace","Unfold obs-fold continuation lines before sending","Validate third-party HTTP writers with integration tests"],"tags":["http","malformed-headers","fasthttp","parser"],"backgroundTag":"malformed-http-header","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}