{"record":{"id":"a0df3f60901d8941","repo":"affaan-m/ECC","slug":"http-request-headers-too-large","errorCode":null,"errorMessage":"HTTP request headers too large","messagePattern":"HTTP request headers too large","errorType":"http","errorClass":"anyhow::Error","httpStatus":null,"severity":"warning","filePath":"ecc2/src/main.rs","lineNumber":4205,"sourceCode":"    }\n}\n\nfn read_http_request(\n    stream: &mut TcpStream,\n) -> Result<(String, String, BTreeMap<String, String>, Vec<u8>)> {\n    let mut buffer = Vec::new();\n    let mut temp = [0_u8; 1024];\n    let header_end = loop {\n        let read = stream.read(&mut temp)?;\n        if read == 0 {\n            anyhow::bail!(\"Unexpected EOF while reading HTTP request\");\n        }\n        buffer.extend_from_slice(&temp[..read]);\n        if let Some(index) = buffer.windows(4).position(|window| window == b\"\\r\\n\\r\\n\") {\n            break index + 4;\n        }\n        if buffer.len() > 64 * 1024 {\n            anyhow::bail!(\"HTTP request headers too large\");\n        }\n    };\n\n    let header_text = String::from_utf8(buffer[..header_end].to_vec())\n        .context(\"HTTP request headers were not valid UTF-8\")?;\n    let mut lines = header_text.split(\"\\r\\n\");\n    let request_line = lines\n        .next()\n        .filter(|line| !line.trim().is_empty())\n        .ok_or_else(|| anyhow::anyhow!(\"Missing HTTP request line\"))?;\n    let mut request_parts = request_line.split_whitespace();\n    let method = request_parts\n        .next()\n        .ok_or_else(|| anyhow::anyhow!(\"Missing HTTP method\"))?\n        .to_string();\n    let path = request_parts\n        .next()\n        .ok_or_else(|| anyhow::anyhow!(\"Missing HTTP path\"))?","sourceCodeStart":4187,"sourceCodeEnd":4223,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/ecc2/src/main.rs#L4187-L4223","documentation":"Raised by `read_http_request` when the in-memory header buffer exceeds 64 KiB before the `\\r\\n\\r\\n` terminator is found. This is a deliberate bound to prevent unbounded memory growth from a malicious or buggy client that streams headers forever without terminating the request. It is a protocol-level guard, not a configuration limit.","triggerScenarios":"A client sends an extremely long header block (huge cookies, very long authorization tokens, or synthetic padding) without the terminating blank line. A malformed client that never sends `\\r\\n\\r\\n`. An attacker attempting a header-based resource exhaustion. A proxy forwarding an oversized accumulated header set.","commonSituations":"Security scanners / fuzzers. Misbehaving proxies that concatenate many forwarded headers. Legitimate clients with exceptionally large cookies or tokens that exceed 64 KiB (rare). Buggy custom integrations that omit the request terminator.","solutions":["Ensure clients send well-formed HTTP requests with headers under 64 KiB total.","If legitimately large headers are expected, raise the cap in `read_http_request` (edit the `64 * 1024` literal) and document the new limit.","Place a reverse proxy (nginx, caddy) in front that enforces its own header limits and rejects abuse before it reaches ECC."],"exampleFix":"// before: hard cap at 64 KiB\nif buffer.len() > 64 * 1024 {\n    anyhow::bail!(\"HTTP request headers too large\");\n}\n\n// after: configurable cap\nconst MAX_HEADER_BYTES: usize = 128 * 1024; // 128 KiB\nif buffer.len() > MAX_HEADER_BYTES {\n    anyhow::bail!(\"HTTP request headers too large\");\n}","handlingStrategy":"validation","validationCode":"// Bound input before it reaches the parser\nconst MAX_HEADER_BYTES: usize = 64 * 1024;\nif buffer.len() > MAX_HEADER_BYTES {\n    stream.write_all(b\"HTTP/1.1 431 Request Header Fields Too Large\\r\\n\\r\\n\")?;\n    return Ok(());\n}","typeGuard":null,"tryCatchPattern":"// Map the bail into a 431 response instead of an error\nmatch read_http_request(&mut stream) {\n    Ok(req) => handle(req),\n    Err(e) if e.to_string().contains(\"headers too large\") => {\n        let _ = stream.write_all(b\"HTTP/1.1 431 Request Header Fields Too Large\\r\\nConnection: close\\r\\n\\r\\n\");\n        return;\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Put a reverse proxy (nginx/caddy) with its own header limits in front of ECC.","Respond with HTTP 431 rather than dropping the connection, so clients get a clear signal.","If legitimately large headers are needed, raise the cap deliberately and document it."],"tags":["network","http","server","security","limits","dos"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}