{"record":{"id":"e59faf6ad7d72893","repo":"valyala/fasthttp","slug":"unsupported-http-version-q","errorCode":null,"errorMessage":"unsupported http version %q","messagePattern":"unsupported http version %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"header.go","lineNumber":2874,"sourceCode":"\t\tstatusCode = b[:n]\n\t\tstatusMessage = b[n+1:]\n\t}\n\tif len(statusCode) != 3 {\n\t\tif h.secureErrorLogMessage {\n\t\t\treturn 0, ErrUnexpectedStatusCodeChar\n\t\t}\n\t\treturn 0, fmt.Errorf(\"invalid response status code %q: response %q\", statusCode, buf)\n\t}\n\th.statusCode, n, err = parseUintBuf(statusCode)\n\tif err != nil || n != 3 {\n\t\tif h.secureErrorLogMessage {\n\t\t\treturn 0, ErrUnexpectedStatusCodeChar\n\t\t}\n\t\treturn 0, fmt.Errorf(\"invalid response status code %q: response %q\", statusCode, buf)\n\t}\n\tif !isHTTPVersion(protoStr) {\n\t\tif h.secureErrorLogMessage {\n\t\t\treturn 0, fmt.Errorf(\"unsupported http version %q\", protoStr)\n\t\t}\n\t\treturn 0, fmt.Errorf(\"unsupported http version %q in %q\", protoStr, buf)\n\t}\n\th.noHTTP11 = !bytes.Equal(protoStr, strHTTP11)\n\th.protocol = append(h.protocol[:0], protoStr...)\n\tif len(statusMessage) > 0 {\n\t\th.SetStatusMessage(statusMessage)\n\t}\n\n\treturn len(buf) - len(bNext), nil\n}\n\nfunc isValidMethod(method []byte) bool {\n\tfor _, ch := range method {\n\t\tif validMethodValueByteTable[ch] == 0 {\n\t\t\treturn false\n\t\t}\n\t}","sourceCodeStart":2856,"sourceCodeEnd":2892,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/header.go#L2856-L2892","documentation":"When secure error logging is enabled, fasthttp reports an unsupported HTTP protocol version without echoing the raw response line. The protocol token from the status line failed isHTTPVersion (must look like HTTP/x.y). This is the privacy-preserving variant of error 139.","triggerScenarios":"ResponseHeader.parseFirstLine with h.secureErrorLogMessage==true and a protoStr (e.g. 'HTTPS', 'FTP', binary junk) that is not an HTTP/1.x or valid HTTP version string.","commonSituations":"Same as the non-secure variant: TLS data sent to a plain-HTTP client, non-HTTP services, misconfigured proxies — but in production configs with SecureErrorLogMessage enabled.","solutions":["Fix the URL scheme/TLS configuration so the client talks to an actual HTTP endpoint","Verify the upstream service speaks HTTP/1.x (not raw TLS, SPDY, or a custom protocol)","Check proxies/load balancers for protocol mismatches (e.g. HTTPS listener forwarding to plaintext expectation)"],"exampleFix":"// before\nvar c fasthttp.Client\nresp, err := c.Get(nil, \"http://tls-only-host/\")\n// after\nvar c fasthttp.Client\nresp, err := c.Get(nil, \"https://tls-only-host/\") // with TLSConfig set","handlingStrategy":"try-catch","validationCode":"u, _ := url.Parse(endpoint)\nif u.Scheme != \"http\" && u.Scheme != \"https\" {\n    return fmt.Errorf(\"unsupported scheme %q\", u.Scheme)\n}","typeGuard":"func isUnsupportedVersionErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"unsupported http version\")\n}","tryCatchPattern":"if err := client.Do(req, resp); err != nil {\n    var sue = strings.Contains(err.Error(), \"unsupported http version\")\n    if sue {\n        return fmt.Errorf(\"endpoint requires a different protocol/TLS: %w\", err)\n    }\n    return err\n}","preventionTips":["Always pair https URLs with a TLS-configured client","Verify upstream protocol support (HTTP/1.x only for fasthttp)","Detect protocol mismatch in integration tests","Document endpoint transport requirements per service"],"tags":["http","protocol-version","response-parsing","fasthttp"],"backgroundTag":"unsupported-http-version","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}