{"record":{"id":"6354b35beeee20de","repo":"valyala/fasthttp","slug":"too-many-transfer-encoding-headers","errorCode":null,"errorMessage":"too many transfer-encoding headers","messagePattern":"too many transfer-encoding headers","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":3106,"sourceCode":"\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif caseInsensitiveCompare(s.key, strSetCookie) {\n\t\t\t\th.cookies, kv = allocArg(h.cookies)\n\t\t\t\tkv.key = getCookieKey(kv.key, s.value)\n\t\t\t\tkv.value = append(kv.value[:0], s.value...)\n\t\t\t\tcontinue\n\t\t\t}\n\t\tcase 't':\n\t\t\tif caseInsensitiveCompare(s.key, strTransferEncoding) {\n\t\t\t\tif h.noHTTP11 {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tif transferEncodingSeen {\n\t\t\t\t\th.connectionClose = true\n\t\t\t\t\tif h.secureErrorLogMessage {\n\t\t\t\t\t\treturn 0, ErrUnsupportedTransferEncoding\n\t\t\t\t\t}\n\t\t\t\t\treturn 0, errors.New(\"too many transfer-encoding headers\")\n\t\t\t\t}\n\t\t\t\ttransferEncodingSeen = true\n\t\t\t\tif !caseInsensitiveCompare(s.value, strChunked) {\n\t\t\t\t\th.connectionClose = true\n\t\t\t\t\tif h.secureErrorLogMessage {\n\t\t\t\t\t\treturn 0, ErrUnsupportedTransferEncoding\n\t\t\t\t\t}\n\t\t\t\t\treturn 0, fmt.Errorf(\"unsupported transfer-encoding: %q\", s.value)\n\t\t\t\t}\n\t\t\t\th.contentLength = -1\n\t\t\t\th.h = setArgBytes(h.h, strTransferEncoding, strChunked, argsHasValue)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif caseInsensitiveCompare(s.key, strTrailer) {\n\t\t\t\terr := h.SetTrailerBytes(s.value)\n\t\t\t\tif err != nil {\n\t\t\t\t\th.connectionClose = true\n\t\t\t\t\treturn 0, err","sourceCodeStart":3088,"sourceCodeEnd":3124,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L3088-L3124","documentation":"fasthttp rejects a message that contains more than one Transfer-Encoding header. Duplicate Transfer-Encoding is a classic HTTP request smuggling vector, so the parser sets connectionClose and fails parsing instead of merging the headers. With secureErrorLogMessage enabled the public ErrUnsupportedTransferEncoding is returned instead of this detailed message.","triggerScenarios":"Parsing incoming request headers (tryReadHeaders/parseHeaders path at header.go:3106) when a second Transfer-Encoding header key is encountered after one was already seen.","commonSituations":"Malicious or buggy clients sending duplicated Transfer-Encoding headers; misconfigured proxies that append TE without removing the original; security scanners probing for request smuggling.","solutions":["Fix or reject the offending client/proxy so only a single Transfer-Encoding: chunked header is sent.","Ensure upstream proxies normalize Transfer-Encoding (remove duplicates before forwarding).","Keep connectionClose behavior (fasthttp already closes the connection) and monitor logs for the source IP.","If you own the sender code, set Transfer-Encoding only once via header.Set, not Add."],"exampleFix":"// before\nreq.Header.Add(\"Transfer-Encoding\", \"chunked\")\nreq.Header.Add(\"Transfer-Encoding\", \"chunked\")\n// after\nreq.Header.Set(\"Transfer-Encoding\", \"chunked\")","handlingStrategy":"validation","validationCode":"func hasSingleTransferEncoding(h map[string][]string) bool {\n    return len(h[\"Transfer-Encoding\"]) <= 1\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use Header.Set, never Add, for Transfer-Encoding","Normalize headers on inbound proxies","Treat duplicates as a smuggling probe and block the source"],"tags":["http","header-parsing","request-smuggling","security"],"backgroundTag":"duplicate-transfer-encoding","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}