{"record":{"id":"d6b21f4de67ff09b","repo":"valyala/fasthttp","slug":"too-many-host-headers","errorCode":null,"errorMessage":"too many host headers","messagePattern":"too many host headers","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":3243,"sourceCode":"\t\t\t\t\t\treturn 0, ErrUnsupportedTransferEncoding\n\t\t\t\t\t}\n\t\t\t\t\treturn 0, errors.New(\"too many transfer-encoding headers\")\n\t\t\t\t}\n\t\t\t\ttransferEncodingSeen = true\n\t\t\t}\n\t\t}\n\n\t\tif h.disableSpecialHeader {\n\t\t\th.h = appendArgBytes(h.h, s.key, s.value, argsHasValue)\n\t\t\tcontinue\n\t\t}\n\n\t\tswitch s.key[0] | 0x20 {\n\t\tcase 'h':\n\t\t\tif caseInsensitiveCompare(s.key, strHost) {\n\t\t\t\tif hostSeen {\n\t\t\t\t\th.connectionClose = true\n\t\t\t\t\treturn 0, errors.New(\"too many host headers\")\n\t\t\t\t}\n\t\t\t\thostSeen = true\n\t\t\t\th.host = append(h.host[:0], s.value...)\n\t\t\t\tcontinue\n\t\t\t}\n\t\tcase 'u':\n\t\t\tif caseInsensitiveCompare(s.key, strUserAgent) {\n\t\t\t\th.userAgent = append(h.userAgent[:0], s.value...)\n\t\t\t\tcontinue\n\t\t\t}\n\t\tcase 'c':\n\t\t\tif caseInsensitiveCompare(s.key, strContentType) {\n\t\t\t\th.contentType = append(h.contentType[:0], s.value...)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif isContentLength {\n\t\t\t\tif h.contentLength != -1 {\n\t\t\t\t\th.contentLength = contentLength","sourceCodeStart":3225,"sourceCodeEnd":3261,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L3225-L3261","documentation":"HTTP semantics allow only one Host header per request. fasthttp enforces this: while parsing headers, if a second Host header is seen it marks the connection close and returns this error. Duplicate Host headers are also a smuggling/confusion vector.","triggerScenarios":"Parsing a request (or message) with two or more Host headers at header.go:3243 in the header scan switch.","commonSituations":"Hand-crafted or malicious requests; buggy HTTP clients that append Host via Add instead of Set; proxies that insert a Host without removing the client's.","solutions":["Fix the client to set Host once (fasthttp sets it from URI automatically; don't Add Host manually).","Normalize requests at the edge proxy (strip duplicate Host before forwarding).","Reject/monitor the offending sender; fasthttp already closes the connection.","If generating requests in tests/tools, build URIs with a single host instead of a manual Host header."],"exampleFix":"// before\nreq.Header.Add(\"Host\", \"a.example.com\")\nreq.Header.Add(\"Host\", \"b.example.com\")\n// after\nreq.SetHost(\"a.example.com\") // or let req.SetRequestURI(\"http://a.example.com/\") set it","handlingStrategy":"validation","validationCode":"func hasSingleHost(h map[string][]string) bool {\n    return len(h[\"Host\"]) <= 1\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never manually Add a Host header; let the HTTP client derive it from the URL","Strip duplicate Host at the edge proxy","Reject duplicate-Host requests with 400 in front of fasthttp"],"tags":["http","header-parsing","host-header","security"],"backgroundTag":"duplicate-host-header","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}