{"record":{"id":"db74f584892b1e3e","repo":"ThreeMammals/Ocelot","slug":"more-data-contentlength-bytes-received-than-the-specified","errorCode":null,"errorMessage":"More data ({contentLength} bytes) received than the specified Content-Length of {announcedContentLength} bytes.","messagePattern":"More data \\((.+?) bytes\\) received than the specified Content-Length of (.+?) bytes\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Request/Mapper/StreamHttpContent.cs","lineNumber":81,"sourceCode":"                else\r\n                {\r\n                    // Take care not to return the same buffer to the pool twice in case zeroByteReadTask throws\r\n                    var bufferToReturn = buffer;\r\n                    buffer = null;\r\n                    ArrayPool<byte>.Shared.Return(bufferToReturn);\r\n\r\n                    await zeroByteReadTask;\r\n\r\n                    buffer = ArrayPool<byte>.Shared.Rent(minBufferSize);\r\n                }\r\n\r\n                var read = await input.ReadAsync(buffer.AsMemory(), cancellation);\r\n                contentLength += read;\r\n\r\n                // Normally this is enforced by the server, but it could get out of sync if something in the proxy modified the body.\r\n                if (announcedContentLength != UnknownLength && contentLength > announcedContentLength)\r\n                {\r\n                    throw new InvalidOperationException($\"More data ({contentLength} bytes) received than the specified Content-Length of {announcedContentLength} bytes.\");\r\n                }\r\n\r\n                // End of the source stream.\r\n                if (read == 0)\r\n                {\r\n                    if (announcedContentLength == UnknownLength || contentLength == announcedContentLength)\r\n                    {\r\n                        return;\r\n                    }\r\n                    else\r\n                    {\r\n                        throw new InvalidOperationException($\"Sent {contentLength} request content bytes, but Content-Length promised {announcedContentLength}.\");\r\n                    }\r\n                }\r\n\r\n                await output.WriteAsync(buffer.AsMemory(0, read), cancellation);\r\n                if (autoFlush)\r\n                {\r","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/ThreeMammals/Ocelot/blob/d1f22d930430410bfd0233f5e9e4f92980cf7df0/src/Request/Mapper/StreamHttpContent.cs#L63-L99","documentation":"Thrown from StreamHttpContent.CopyAsync (invoked via SerializeToStreamAsync when Ocelot serializes the proxied request body): while streaming the incoming request stream into the outgoing request content, the accumulated byte count contentLength exceeds announcedContentLength, the Content-Length header the client declared. Normally the server enforces this, but a proxy component that modified or duplicated the body without updating Content-Length desynchronizes the two values. CopyAsync detects the mismatch mid-copy, throws InvalidOperationException, and abandons the forward — the pool buffer is returned and the request fails rather than sending a body that violates the promised length to the downstream service. The input at fault is the request body stream/its Content-Length header pair, corrupted by an upstream modifier (e.g. a DelegatingHandler or middleware that rewrote the body).","triggerScenarios":"Thrown at src/Request/Mapper/StreamHttpContent.cs:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Find and fix the component (custom middleware, DelegatingHandler, request mapper) that modified the proxied body without updating the Content-Length header.","Remove or recompute Content-Length after body modification, or switch the outgoing request to chunked transfer (no Content-Length) when the length is unknown.","Log the original and rewritten bodies with their lengths to identify where the extra bytes are introduced.","Guard any custom IStreamContent/body rewriting code so it can only shrink or must resize Content-Length accordingly.","Retry-safe option: catch the InvalidOperationException at the request-serialization boundary and return 400 Bad Request to the client, since the client's own declared length was violated."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d1f22d930430410bfd0233f5e9e4f92980cf7df0","analyzedAt":"2026-09-12T13:50:06.067Z","contentChangedAt":"2026-09-12T13:50:06.067Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}