{"record":{"id":"7569090ddf1ee368","repo":"valyala/fasthttp","slug":"invalid-trailer-value-q","errorCode":null,"errorMessage":"invalid trailer value %q","messagePattern":"invalid trailer value %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":2751,"sourceCode":"\ts.b = src\n\n\tfor s.next() {\n\t\t// Trim trailing whitespace before the colon to normalize headers\n\t\t// like \"Content-Length :\" to \"Content-Length:\".\n\t\ts.key = trimTrailingSpace(s.key)\n\n\t\tif len(s.key) == 0 {\n\t\t\tcontinue\n\t\t}\n\t\t// Key bytes were already validated by the scanner.\n\t\tdisable := disableNormalizing || s.keyHasSpace\n\t\t// Forbidden by RFC 7230, section 4.1.2\n\t\tif isBadTrailer(s.key) {\n\t\t\treturn dest, 0, fmt.Errorf(\"forbidden trailer key %q\", s.key)\n\t\t}\n\t\tfor _, ch := range s.value {\n\t\t\tif !validHeaderValueByte(ch) {\n\t\t\t\treturn dest, 0, fmt.Errorf(\"invalid trailer value %q\", s.value)\n\t\t\t}\n\t\t}\n\t\tnormalizeHeaderKeyValidated(s.key, disable)\n\t\tdest = appendArgBytes(dest, s.key, s.value, argsHasValue)\n\t}\n\tif s.err != nil {\n\t\treturn dest, 0, s.err\n\t}\n\treturn dest, s.r, nil\n}\n\nfunc isBadTrailer(key []byte) bool {\n\tif len(key) == 0 {\n\t\treturn true\n\t}\n\n\tswitch key[0] | 0x20 {\n\tcase 'a':","sourceCodeStart":2733,"sourceCodeEnd":2769,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L2733-L2769","documentation":"Every byte of a chunked trailer value must be a valid header-value byte. fasthttp throws this when a trailer value contains control characters (other than allowed obs-fold/HTAB) or other bytes disallowed by RFC 7230.","triggerScenarios":"readTrailer encounters a trailer whose value contains bytes failing validHeaderValueByte — e.g. raw \\r, \\n (unfolding failure), NUL, or other control characters.","commonSituations":"Malicious clients injecting CRLF into trailer values (request smuggling attempts); buggy custom HTTP clients writing raw binary into trailers; corrupted streams from faulty intermediaries.","solutions":["Sanitize the sender: ensure trailer values contain only printable ASCII/obs-text with no bare CR/LF","Upgrade or patch the client producing the trailers","Reject such requests at an edge proxy before they reach fasthttp","Investigate repeated occurrences as potential request-smuggling probes"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func validTrailerValue(s string) bool {\n    for i := 0; i < len(s); i++ {\n        b := s[i]\n        if b < 0x20 && b != '\\t' { return false }\n        if b == 0x7f { return false }\n    }\n    return true\n}","typeGuard":null,"tryCatchPattern":"if err := h.Read(br); err != nil && strings.Contains(err.Error(), \"invalid trailer value\") {\n    log.Warn(\"malformed trailer value — possible smuggling attempt\", \"remote\", ctx.RemoteAddr())\n    ctx.ResetConnection()\n    return\n}","preventionTips":["Sanitize trailer values to printable ASCII before sending","Treat repeated violations as hostile traffic (request smuggling probe)","Reject non-conformant trailers at the edge proxy","Fuzz your own clients' trailer generation"],"tags":["http","trailer","header-validation","fasthttp"],"backgroundTag":"invalid-http-trailer","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}