{"record":{"id":"6d77fe847531dc14","repo":"XTLS/Xray-core","slug":"invalid-negative-value-of-maxheaderbytes","errorCode":null,"errorMessage":"invalid negative value of maxHeaderBytes","messagePattern":"invalid negative value of maxHeaderBytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_method.go","lineNumber":446,"sourceCode":"\t\tswitch c.SeqPlacement {\n\t\tcase \"cookie\", \"query\":\n\t\t\tc.SeqKey = \"x_seq\"\n\t\tcase \"header\":\n\t\t\tc.SeqKey = \"X-Seq\"\n\t\t}\n\t}\n\n\tif c.UplinkDataPlacement != splithttp.PlacementBody && c.UplinkDataKey == \"\" {\n\t\tswitch c.UplinkDataPlacement {\n\t\tcase splithttp.PlacementCookie:\n\t\t\tc.UplinkDataKey = \"x_data\"\n\t\tcase splithttp.PlacementAuto, splithttp.PlacementHeader:\n\t\t\tc.UplinkDataKey = \"X-Data\"\n\t\t}\n\t}\n\n\tif c.ServerMaxHeaderBytes < 0 {\n\t\treturn nil, errors.New(\"invalid negative value of maxHeaderBytes\")\n\t}\n\n\tif c.Xmux.MaxConnections.To > 0 && c.Xmux.MaxConcurrency.To > 0 {\n\t\treturn nil, errors.New(\"maxConnections cannot be specified together with maxConcurrency\")\n\t}\n\tif c.Xmux == (XmuxConfig{}) {\n\t\tc.Xmux.MaxConnections.From = 3\n\t\tc.Xmux.MaxConnections.To = 3\n\t\tc.Xmux.HMaxRequestTimes.From = 600\n\t\tc.Xmux.HMaxRequestTimes.To = 900\n\t\tc.Xmux.HMaxReusableSecs.From = 1800\n\t\tc.Xmux.HMaxReusableSecs.To = 3000\n\t}\n\n\tconfig := &splithttp.Config{\n\t\tHost:                 c.Host,\n\t\tPath:                 c.Path,\n\t\tMode:                 c.Mode,","sourceCodeStart":428,"sourceCodeEnd":464,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_method.go#L428-L464","documentation":"SplitHTTPConfig.Build() rejects negative \"serverMaxHeaderBytes\" at transport_method.go:445-447. This field (int32, mapped from json \"serverMaxHeaderBytes\") bounds the size of headers the server will read; negative values are meaningless. Zero is allowed and typically means 'use Go http.Server default' semantics.","triggerScenarios":"\"serverMaxHeaderBytes\": -1 (or any negative) in splithttp transportSettings on the inbound/server side; a negative value inside \"extra\" copied into the effective config.","commonSituations":"Copy-paste arithmetic errors; intending 'unlimited' and writing -1 (not supported — use a large positive value or omit); sign typos.","solutions":["Remove \"serverMaxHeaderBytes\" to use the default","Or set it to a non-negative byte count: \"serverMaxHeaderBytes\": 8192"],"exampleFix":"// before\n\"serverMaxHeaderBytes\": -1\n// after\n\"serverMaxHeaderBytes\": 8192","handlingStrategy":"validation","validationCode":"// Go: non-negative serverMaxHeaderBytes\nif cfg.ServerMaxHeaderBytes < 0 {\n\treturn errors.New(\"serverMaxHeaderBytes must be >= 0 or omitted\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use 0/omit for default; large positive for a bigger cap; negatives are invalid"],"tags":["config","splithttp","server","validation"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}