{"record":{"id":"60f722da3a73e15e","repo":"eclipse-vertx/vert.x","slug":"a-header-value-contains-a-prohibited-character-12","errorCode":null,"errorMessage":"a header value contains a prohibited character '127': <value>","messagePattern":"a header value contains a prohibited character '127': <value>","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/http/impl/HttpUtils.java","lineNumber":635,"sourceCode":"    } else if (value instanceof String) {\n      validateStringHeaderValue((String) value);\n    } else {\n      validateSequenceHeaderValue(value);\n    }\n  }\n\n  private static void validateAsciiHeaderValue(AsciiString value) {\n    final int length = value.length();\n    if (length == 0) {\n      return;\n    }\n    byte[] asciiChars = value.array();\n    int off = value.arrayOffset();\n    if (off == 0 && length == asciiChars.length) {\n      for (int index = 0; index < asciiChars.length; index++) {\n        int latinChar = asciiChars[index] & 0xFF;\n        if (latinChar == 0x7F) {\n          throw new IllegalArgumentException(\"a header value contains a prohibited character '127': \" + value);\n        }\n        // non-printable chars are rare so let's make it a fall-back method, whilst still accepting HTAB\n        if (latinChar < 32 && latinChar != 0x09) {\n          validateSequenceHeaderValue(value, index - off);\n          break;\n        }\n      }\n    } else {\n      validateAsciiRangeHeaderValue(value, off, length, asciiChars);\n    }\n  }\n\n  /**\n   * This method is the slow-path generic version of {@link #validateAsciiHeaderValue(AsciiString)} which\n   * is optimized for {@link AsciiString} instances which are backed by a 0-offset full-blown byte array.\n   */\n  private static void validateAsciiRangeHeaderValue(AsciiString value, int off, int length, byte[] asciiChars) {\n    int end = off + length;","sourceCodeStart":617,"sourceCodeEnd":653,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/http/impl/HttpUtils.java#L617-L653","documentation":"HTTP header values must be printable ASCII; Vert.x validates them before writing to the wire. A byte equal to 0x7F (DEL, decimal 127) anywhere in the value is prohibited and triggers this IllegalArgumentException. It is thrown from the fast-path validation scanning the full backing byte array (offset 0, full length).","triggerScenarios":"Calling headers.add/set with an AsciiString/Buffer-backed value whose ASCII bytes include 0x7F, detected in the whole-array fast path (off == 0 && length == array length).","commonSituations":"Building header values from binary data or tokens that contain DEL; corrupt or truncated input; naive byte-array-to-String conversions carrying control characters.","solutions":["Sanitize the header value: strip or encode characters outside 0x20-0x7E (and HTAB)","Inspect the offending value bytes to find the source of the 0x7F byte","Base64-encode binary payloads before placing them in header values"],"exampleFix":"// before\nString token = new String(rawBytes);\nheaders.add(\"X-Token\", token); // rawBytes may contain 0x7F\n// after\nString token = Base64.getEncoder().encodeToString(rawBytes);\nheaders.add(\"X-Token\", token);","handlingStrategy":"validation","validationCode":"static boolean isPrintableAscii(byte[] b) {\n  for (byte x : b) { int c = x & 0xFF; if (c == 0x7F || (c < 0x20 && c != 0x09)) return false; }\n  return true;\n}\n// call before headers.add/set","typeGuard":null,"tryCatchPattern":"try {\n  headers.add(name, value);\n} catch (IllegalArgumentException e) {\n  headers.add(name, sanitize(value));\n}","preventionTips":["Sanitize all header values against non-printable ASCII","Base64-encode binary data instead of raw byte strings in headers","Check encodings of data feeding headers"],"tags":["http","headers","validation","ascii"],"backgroundTag":"invalid-header-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}