{"record":{"id":"327cd3f1a80faf78","repo":"eclipse-vertx/vert.x","slug":"a-header-value-contains-a-prohibited-character-c","errorCode":null,"errorMessage":"a header value contains a prohibited character '<charCode>': <seq>","messagePattern":"a header value contains a prohibited character '<charCode>': <seq>","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/http/impl/HttpUtils.java","lineNumber":787,"sourceCode":"            return NO_CR_LF_STATE;\n          default:\n            throw new IllegalArgumentException(\"only ' ' and '\\\\t' are allowed after '\\\\n': \" + seq);\n        }\n      default:\n        // this should never happen\n        throw new AssertionError();\n    }\n  }\n\n  private static void validateNonPrintableCtrlChar(CharSequence seq, int ch) {\n    // The only characters allowed in the range 0x00-0x1F are : HTAB, LF and CR\n    switch (ch) {\n      case 0x09: // Horizontal tab - HTAB\n      case 0x0a: // Line feed - LF\n      case 0x0d: // Carriage return - CR\n        break;\n      default:\n        throw new IllegalArgumentException(\"a header value contains a prohibited character '\" + (int) ch + \"': \" + seq);\n    }\n  }\n\n  private static final boolean[] VALID_H_NAME_ASCII_CHARS;\n\n  static {\n    VALID_H_NAME_ASCII_CHARS = new boolean[Byte.MAX_VALUE + 1];\n    Arrays.fill(VALID_H_NAME_ASCII_CHARS, true);\n    VALID_H_NAME_ASCII_CHARS[' '] = false;\n    VALID_H_NAME_ASCII_CHARS['\"'] = false;\n    VALID_H_NAME_ASCII_CHARS['('] = false;\n    VALID_H_NAME_ASCII_CHARS[')'] = false;\n    VALID_H_NAME_ASCII_CHARS[','] = false;\n    VALID_H_NAME_ASCII_CHARS['/'] = false;\n    VALID_H_NAME_ASCII_CHARS[':'] = false;\n    VALID_H_NAME_ASCII_CHARS[';'] = false;\n    VALID_H_NAME_ASCII_CHARS['<'] = false;\n    VALID_H_NAME_ASCII_CHARS['>'] = false;","sourceCodeStart":769,"sourceCodeEnd":805,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/http/impl/HttpUtils.java#L769-L805","documentation":"Vert.x validates every character of an HTTP header value. Control characters in the 0x00–0x1F range other than HTAB (0x09), LF (0x0A) and CR (0x0D) are prohibited per RFC 7230 (field-content rules), as is DEL (0x7F). This exception is thrown when such a character is found, with its numeric code included in the message.","triggerScenarios":"Putting/setting a header value that contains characters like NUL (0x00), vertical tab (0x0B), form feed (0x0C), escape (0x1B) or other control characters; thrown from HttpUtils.validateNonPrintableCtrlChar during validateHeaderValue.","commonSituations":"Including ANSI color escape sequences (0x1B) from terminal output in a header; passing binary/protobuf or other raw bytes decoded into a String; string data read from files or streams containing BOM/NUL characters.","solutions":["Strip control characters before setting the header: value.replaceAll(\"[\\\\x00-\\\\x08\\\\x0B\\\\x0C\\\\x0E-\\\\x1F\\\\x7F]\", \"\").","Encode binary data as Base64 before placing it in a header.","Check the reported numeric code in the message to identify which character leaked from which upstream data source."],"exampleFix":"// before\nrequest.putHeader(\"X-Data\", ansiColoredLog); // contains 0x1B -> throws\n// after\nString clean = ansiColoredLog.replaceAll(\"\\\\x1B\\\\[[0-9;]*m\", \"\").replaceAll(\"[\\\\x00-\\\\x08\\\\x0B\\\\x0C\\\\x0E-\\\\x1F\\\\x7F]\", \"\");\nrequest.putHeader(\"X-Data\", clean);","handlingStrategy":"validation","validationCode":"public static String sanitizeHeaderValue(String v) {\n  return v.replaceAll(\"[\\\\x00-\\\\x08\\\\x0B\\\\x0C\\\\x0E-\\\\x1F\\\\x7F]\", \"\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  request.putHeader(name, rawValue);\n} catch (IllegalArgumentException e) {\n  request.putHeader(name, sanitizeHeaderValue(rawValue));\n}","preventionTips":["Never put binary or ANSI-escaped data into header values; use Base64 encoding","Strip control characters from any externally sourced string before using it as a header value","Parse the numeric code from the error message to trace the contaminated input source"],"tags":["http","headers","validation","control-characters"],"backgroundTag":"invalid-argument-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}