{"record":{"id":"1da8c27bb1048ab7","repo":"Netflix/zuul","slug":"invalid-host","errorCode":null,"errorMessage":"Invalid host","messagePattern":"Invalid host","errorType":"validation","errorClass":"URISyntaxException","httpStatus":null,"severity":"error","filePath":"zuul-core/src/main/java/com/netflix/zuul/message/http/HttpRequestMessageImpl.java","lineNumber":597,"sourceCode":"    private static Pair<String, Integer> parseHostHeader(Headers headers) throws URISyntaxException {\n        String host = headers.getFirst(HttpHeaderNames.HOST);\n        if (host == null) {\n            return new Pair<>(null, -1);\n        }\n\n        try {\n            // attempt to use default URI parsing - this can fail when not strictly following RFC2396,\n            // for example, having underscores in host names will fail parsing\n            URI uri = new URI(/* scheme= */ null, host, /* path= */ null, /* query= */ null, /* fragment= */ null);\n            if (uri.getHost() != null) {\n                return new Pair<>(uri.getHost(), uri.getPort());\n            }\n        } catch (URISyntaxException e) {\n            LOG.debug(\"URI parsing failed\", e);\n        }\n\n        if (STRICT_HOST_HEADER_VALIDATION.get()) {\n            throw new URISyntaxException(host, \"Invalid host\");\n        }\n\n        // fallback to using a colon split\n        // valid IPv6 addresses would have been handled already so any colon is safely assumed a port separator\n        String[] components = host.split(\":\", -1);\n        if (components.length > 2) {\n            // handle case with unbracketed IPv6 addresses\n            return new Pair<>(null, -1);\n        }\n\n        String parsedHost = components[0];\n        int parsedPort = -1;\n        if (components.length > 1) {\n            try {\n                parsedPort = Integer.parseInt(components[1]);\n            } catch (NumberFormatException e) {\n                // ignore failing to parse port numbers and fallback to default port\n                LOG.debug(\"Parsing of host port component failed\", e);","sourceCodeStart":579,"sourceCodeEnd":615,"githubUrl":"https://github.com/Netflix/zuul/blob/14bf53c52dcf571894619ff65a674cbe2cce3ac6/zuul-core/src/main/java/com/netflix/zuul/message/http/HttpRequestMessageImpl.java#L579-L615","documentation":"parseHostHeader validates the Host header of an inbound request. It first tries strict RFC2396 parsing via java.net.URI; if that fails (e.g. underscores in the hostname, malformed port) and the STRICT_HOST_HEADER_VALIDATION flag is enabled, it throws a URISyntaxException with 'Invalid host'. The input at fault is the raw Host header value, which is not a valid RFC2396 authority.","triggerScenarios":"Thrown at zuul-core/src/main/java/com/netflix/zuul/message/http/HttpRequestMessageImpl.java:597 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the Host header sent by the client so it is a valid RFC2396 host[:port] (no underscores, bracketed IPv6, valid port)","Disable strict validation via the STRICT_HOST_HEADER_VALIDATION flag so Zuul falls back to the lenient colon-split parsing path","If you control a proxy in front of Zuul, sanitize or rewrite malformed Host headers before forwarding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"14bf53c52dcf571894619ff65a674cbe2cce3ac6","analyzedAt":"2026-09-07T10:00:54.873Z","contentChangedAt":"2026-09-07T10:00:54.873Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}