{"record":{"id":"c86f3cf7b7b94283","repo":"valyala/fasthttp","slug":"malformed-mime-header-line-q","errorCode":null,"errorMessage":"malformed mime header line: %q","messagePattern":"malformed mime header line: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"headerscanner.go","lineNumber":69,"sourceCode":"\t\tif len(s.b) > 0 && (s.b[0] == ' ' || s.b[0] == '\\t') {\n\t\t\ts.err = errors.New(\"invalid headers, headers cannot start with space or tab\")\n\t\t\treturn false\n\t\t}\n\n\t\ts.initialized = true\n\t}\n\n\tkv, colon, err := s.readContinuedLineSlice()\n\tif len(kv) == 0 {\n\t\ts.err = err\n\t\treturn false\n\t}\n\n\t// Key ends at the first colon, already found by readContinuedLineSlice.\n\tk, v := kv[:colon], kv[colon+1:]\n\tvalid, innerSpace := isValidHeaderKey(k)\n\tif !valid {\n\t\ts.err = fmt.Errorf(\"malformed mime header line: %q\", kv)\n\t\treturn false\n\t}\n\ts.keyHasSpace = innerSpace\n\n\t// Skip initial spaces in value, without bytes.TrimLeft: it would\n\t// rebuild its ASCII set on every call.\n\tfor len(v) > 0 && (v[0] == ' ' || v[0] == '\\t') {\n\t\tv = v[1:]\n\t}\n\n\ts.key = k\n\ts.value = v\n\n\tif err != nil {\n\t\ts.err = err\n\t\treturn false\n\t}\n","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/headerscanner.go#L51-L87","documentation":"The MIME header scanner (headerscanner.next) validates each header key with isValidHeaderKey; keys containing illegal bytes or interior spaces make the whole line invalid, so scanning stops with this error and the connection is closed by callers (parseHeaders, parseTrailer).","triggerScenarios":"A header line whose key contains spaces or illegal characters, e.g. 'Bad Key: value' or 'X(1): value', encountered while parsing headers or trailers.","commonSituations":"HTTP request smuggling probes; broken embedded-device HTTP stacks; headers corrupted by manual socket writes or faulty serialization in upstream services.","solutions":["Fix the producer to send RFC-compliant header names (token characters only, no spaces).","Sanitize dynamically built header names before writing them to the wire.","Drop/normalize malformed lines at an upstream gateway before fasthttp parses them.","Capture raw traffic to identify exactly which line fails and who sent it."],"exampleFix":"// before\nX My Header: value\r\n// after\nX-My-Header: value\r\n","handlingStrategy":"validation","validationCode":"func isValidKey(k string) bool {\n    if len(k) == 0 { return false }\n    for i := 0; i < len(k); i++ {\n        b := k[i]\n        if b <= ' ' || b >= 0x7f { return false }\n    }\n    return true\n} // mirrors isValidHeaderKey used by the scanner","typeGuard":null,"tryCatchPattern":"if !s.next() && s.err != nil && strings.Contains(s.err.Error(), \"malformed mime header line\") {\n    // abort parse, respond 400\n}","preventionTips":["Use only RFC token characters in header names","Sanitize header names built from external input","Add integration tests that roundtrip generated headers"],"tags":["http","fasthttp","mime-header","malformed"],"backgroundTag":"malformed-mime-header","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}