{"record":{"id":"67ff3eeb3ad962ab","repo":"elastic/elasticsearch","slug":"invalid-parameters-for-header","errorCode":null,"errorMessage":"invalid parameters for header [{}]","messagePattern":"invalid parameters for header \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"libs/x-content/src/main/java/org/elasticsearch/xcontent/ParsedMediaType.java","lineNumber":86,"sourceCode":"            final String[] splitMediaType = elements[0].split(\"/\");\n            if ((splitMediaType.length == 2\n                && TCHAR_PATTERN.matcher(splitMediaType[0].trim()).matches()\n                && TCHAR_PATTERN.matcher(splitMediaType[1].trim()).matches()) == false) {\n                throw new IllegalArgumentException(\"invalid media-type [\" + headerValue + \"]\");\n            }\n            if (elements.length == 1) {\n                return new ParsedMediaType(headerValue, splitMediaType[0].trim(), splitMediaType[1].trim(), new HashMap<>());\n            } else {\n                Map<String, String> parameters = new HashMap<>();\n                for (int i = 1; i < elements.length; i++) {\n                    String paramsAsString = elements[i].trim();\n                    if (paramsAsString.isEmpty()) {\n                        continue;\n                    }\n                    // spaces are allowed between parameters, but not between '=' sign\n                    String[] keyValueParam = paramsAsString.split(\"=\");\n                    if (keyValueParam.length != 2 || hasTrailingSpace(keyValueParam[0]) || hasLeadingSpace(keyValueParam[1])) {\n                        throw new IllegalArgumentException(\"invalid parameters for header [\" + headerValue + \"]\");\n                    }\n                    String parameterName = keyValueParam[0].toLowerCase(Locale.ROOT).trim();\n                    String parameterValue = keyValueParam[1].toLowerCase(Locale.ROOT).trim();\n                    parameters.put(parameterName, parameterValue);\n                }\n                return new ParsedMediaType(\n                    headerValue,\n                    splitMediaType[0].trim().toLowerCase(Locale.ROOT),\n                    splitMediaType[1].trim().toLowerCase(Locale.ROOT),\n                    parameters\n                );\n            }\n        }\n        return null;\n    }\n\n    public static ParsedMediaType parseMediaType(XContentType requestContentType, Map<String, String> parameters) {\n        ParsedMediaType parsedMediaType = requestContentType.toParsedMediaType();","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/x-content/src/main/java/org/elasticsearch/xcontent/ParsedMediaType.java#L68-L104","documentation":"Thrown by ParsedMediaType.parseMediaType() when the parameter portion of the media type (everything after the first ';') is malformed. Each parameter must be a key=value pair with exactly one '=', no trailing space before '=', and no leading space after '='. Violating any of these produces this error.","triggerScenarios":"Sending a Content-Type like 'application/json; charset =utf-8' (space before '='), 'application/json; charset= utf-8' (space after '='), 'application/json; charset' (missing '='), or 'application/json; =utf8' (empty parameter name).","commonSituations":"Manually constructing Content-Type headers with spaces around the '=' sign. A proxy or middleware that reformats headers and introduces spaces. Copying a header from documentation that has formatting whitespace.","solutions":["Remove spaces around the '=' sign in media type parameters.","Use 'application/json; charset=utf-8' (no spaces around '=').","Let the HTTP client library construct the Content-Type header rather than building it manually.","Validate parameter format against RFC 7231 before sending."],"exampleFix":"// before — space around '=' in parameter\nContent-Type: application/json; charset = utf-8\n\n// after — no spaces around '='\nContent-Type: application/json; charset=utf-8","handlingStrategy":"validation","validationCode":"// Validate parameter format: key=value with no spaces around '='\npublic static void validateMediaTypeParams(String header) {\n    String[] parts = header.split(\";\", 2);\n    if (parts.length == 2) {\n        for (String param : parts[1].split(\";\")) {\n            String[] kv = param.trim().split(\"=\");\n            if (kv.length != 2 || kv[0].isEmpty() || kv[0].endsWith(\" \") || kv[1].startsWith(\" \")) {\n                throw new IllegalArgumentException(\"Invalid parameter format in: \" + header);\n            }\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    ParsedMediaType parsed = ParsedMediaType.parseMediaType(header);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"invalid parameters\")) {\n        return ResponseEntity.status(415).body(\"Malformed Content-Type parameters\");\n    }\n    throw e;\n}","preventionTips":["Never put spaces around '=' in Content-Type parameters.","Let the HTTP client library construct headers; avoid manual string concatenation.","Test header parsing with a variety of parameter formats in integration tests."],"tags":["http","xcontent","media-type","header-validation","content-type","parameters"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}