{"record":{"id":"55c0980ac67186a2","repo":"TooTallNate/Java-WebSocket","slug":"1007-55c098","errorCode":"1007","errorMessage":"Control frame can't have rsv1==true set","messagePattern":"Control frame can't have rsv1==true set","errorType":"exception","errorClass":"InvalidFrameException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/framing/ControlFrame.java","lineNumber":52,"sourceCode":" */\npublic abstract class ControlFrame extends FramedataImpl1 {\n\n  /**\n   * Class to represent a control frame\n   *\n   * @param opcode the opcode to use\n   */\n  public ControlFrame(Opcode opcode) {\n    super(opcode);\n  }\n\n  @Override\n  public void isValid() throws InvalidDataException {\n    if (!isFin()) {\n      throw new InvalidFrameException(\"Control frame can't have fin==false set\");\n    }\n    if (isRSV1()) {\n      throw new InvalidFrameException(\"Control frame can't have rsv1==true set\");\n    }\n    if (isRSV2()) {\n      throw new InvalidFrameException(\"Control frame can't have rsv2==true set\");\n    }\n    if (isRSV3()) {\n      throw new InvalidFrameException(\"Control frame can't have rsv3==true set\");\n    }\n  }\n}\n","sourceCodeStart":34,"sourceCodeEnd":62,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/framing/ControlFrame.java#L34-L62","documentation":"RSV bits are reserved for extensions; a control frame must have RSV1/RSV2/RSV3 all zero unless a negotiated extension explicitly defines control-frame usage (permessage-deflate does not). ControlFrame.isValid throws InvalidFrameException when RSV1 is set on a control frame.","triggerScenarios":"A ping, pong, or close frame arrives with RSV1 set — e.g. a peer wrongly applying the permessage-deflate RSV1 compression flag to control frames, or a frame builder setting extension bits indiscriminately.","commonSituations":"Clients that compress all frames including pings after negotiating permessage-deflate; custom/patched frame serialization; fuzzed input testing the endpoint's strictness.","solutions":["Fix the peer so control frames are never compressed and RSV1 stays 0 (per RFC 7692, only data frames are compressed).","If building frames manually, leave rsv1/rsv2/rsv3 false for control frames.","Verify which extensions were negotiated — no standard WebSocket extension sets RSV1 on control frames.","Log raw frame headers to identify the offending peer implementation."],"exampleFix":"// before: compressing a ping like a data frame\nFramedata ping = new FramedataImpl1(Opcode.PING);\nping.setRSV1(true); // invalid for control frames\n\n// after\nFramedata ping = new FramedataImpl1(Opcode.PING);\nping.setRSV1(false);","handlingStrategy":"validation","validationCode":"// control frames must not carry RSV bits\nif (isControlOpcode(frame.getOpcode()) && (frame.isRSV1() || frame.isRSV2() || frame.isRSV3())) {\n    throw new IllegalArgumentException(\"control frames must not set RSV bits\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    validateFrame(frame);\n} catch (InvalidFrameException e) {\n    logger.warn(\"control frame with RSV bits from peer: {}\", e.getMessage());\n    webSocket.close(1002, \"protocol error\");\n}","preventionTips":["Never compress control frames even when permessage-deflate is negotiated","Leave RSV1/2/3 false on all control frames","Verify peer implementations with an interop test suite"],"tags":["websocket","control-frame","rsv-bits","permessage-deflate","frame-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}