{"record":{"id":"7dd071b086a0523b","repo":"slimtoolkit/slim","slug":"bad-http-status-d","errorCode":null,"errorMessage":"bad http status - %d","messagePattern":"bad http status - (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/vulnerability/epss/api/api.go","lineNumber":542,"sourceCode":"\t\t\tdefer resp.Body.Close()\n\t\t}\n\n\t\tif err != nil {\n\t\t\tlogger.WithError(err).Error(\"ref.client.Do\")\n\t\t\treturn resp, err\n\t\t}\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\tlogger.WithField(\"status.code\", resp.StatusCode).Error(\"ref.client.Do\")\n\n\t\t\tif resp.StatusCode == http.StatusNotFound {\n\t\t\t\treturn resp, epss.ErrNotFound\n\t\t\t}\n\t\t\tif resp.StatusCode == http.StatusForbidden {\n\t\t\t\treturn resp, epss.ErrNotAuthorized\n\t\t\t}\n\n\t\t\treturn resp, fmt.Errorf(\"bad http status - %d\", resp.StatusCode)\n\t\t}\n\n\t\tif output != nil {\n\t\t\tvar b bytes.Buffer\n\t\t\tb.ReadFrom(resp.Body)\n\n\t\t\tif output.decoded != nil && outFormat == epss.OutJSON {\n\t\t\t\t//non-json responses are returned as raw strings\n\t\t\t\tdecoder := json.NewDecoder(bytes.NewReader(b.Bytes()))\n\t\t\t\terr = decoder.Decode(output.decoded)\n\t\t\t\tif err != nil {\n\t\t\t\t\tlogger.WithFields(log.Fields{\n\t\t\t\t\t\t\"error\":          err,\n\t\t\t\t\t\t\"output.decoded\": output.decoded,\n\t\t\t\t\t}).Error(\"decoder.Decode\")\n\t\t\t\t\treturn resp, err\n\t\t\t\t}\n\t\t\t}","sourceCodeStart":524,"sourceCodeEnd":560,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/vulnerability/epss/api/api.go#L524-L560","documentation":"The EPSS API client's call() validates the HTTP response status; only success (and mapped NotFound/Forbidden sentinel errors) proceed. Any other non-success status — e.g. 500, 429, 401 — is converted to this error carrying the numeric status code. It indicates the remote EPSS service rejected or failed the request.","triggerScenarios":"Calling GenericListCall or GenericLookupCall when the EPSS HTTP endpoint returns an unexpected status: server errors (5xx), rate limiting (429), or authentication failures (401) other than the 403 sentinel.","commonSituations":"EPSS service outage, aggressive polling hitting rate limits, expired or missing API credentials in the environment, or a proxy returning an error page.","solutions":["Log/inspect resp.StatusCode and retry with exponential backoff for transient 5xx/429 statuses.","Check API credentials and quota if the status is 401/403.","Check the EPSS service status page/endpoint availability before assuming client error.","Verify network/proxy configuration if the status indicates an intermediary error."],"exampleFix":"// before\nresp, err := client.GenericLookupCall(cve)\nif err != nil { return err }\n// after\nresp, err := client.GenericLookupCall(cve)\nif err != nil {\n    var statusErr *fmt.Errorf // unwrap to inspect status\n    if strings.Contains(err.Error(), \"bad http status - 429\") {\n        time.Sleep(backoff); return retry(cve)\n    }\n    return err\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"resp, err := client.GenericLookupCall(cve)\nif err != nil {\n    if errors.Is(err, epss.ErrNotFound) { return nil, nil }\n    if errors.Is(err, epss.ErrNotAuthorized) { return nil, fmt.Errorf(\"check EPSS credentials\") }\n    if strings.Contains(err.Error(), \"bad http status - 429\") ||\n       strings.Contains(err.Error(), \"bad http status - 5\") {\n        return backoffRetry(cve)\n    }\n    return nil, err\n}","preventionTips":["Rate-limit EPSS requests and cache responses to reduce call volume.","Keep API credentials current and monitor for 401/403 responses.","Watch the EPSS service status and implement circuit-breaking on repeated 5xx."],"tags":["network","http","api","vulnerability"],"backgroundTag":"bad-http-status","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}