{"record":{"id":"eb8fd16b9942f45b","repo":"caddyserver/caddy","slug":"malformed-content-type","errorCode":null,"errorMessage":"malformed Content-Type","messagePattern":"malformed Content-Type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"caddyconfig/load.go","lineNumber":201,"sourceCode":"\t}\n\n\tct, _, err := mime.ParseMediaType(contentType)\n\tif err != nil {\n\t\treturn nil, nil, caddy.APIError{\n\t\t\tHTTPStatus: http.StatusBadRequest,\n\t\t\tErr:        fmt.Errorf(\"invalid Content-Type: %v\", err),\n\t\t}\n\t}\n\n\t// if already JSON, no need to adapt\n\tif strings.HasSuffix(ct, \"/json\") {\n\t\treturn body, nil, nil\n\t}\n\n\t// adapter name should be suffix of MIME type\n\t_, adapterName, slashFound := strings.Cut(ct, \"/\")\n\tif !slashFound {\n\t\treturn nil, nil, fmt.Errorf(\"malformed Content-Type\")\n\t}\n\n\tcfgAdapter := GetAdapter(adapterName)\n\tif cfgAdapter == nil {\n\t\treturn nil, nil, fmt.Errorf(\"unrecognized config adapter '%s'\", adapterName)\n\t}\n\n\tresult, warnings, err := cfgAdapter.Adapt(body, nil)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"adapting config using %s adapter: %v\", adapterName, err)\n\t}\n\n\treturn result, warnings, nil\n}\n\nvar bufPool = sync.Pool{\n\tNew: func() any {\n\t\treturn new(bytes.Buffer)","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/load.go#L183-L219","documentation":"Returned when the parsed media type contains no '/' after strings.Cut, meaning the adapter name cannot be extracted. In practice this is nearly unreachable because mime.ParseMediaType already rejects slash-less types, so it exists as a defensive check. If seen, it indicates a type that passed MIME parsing but has no subtype component.","triggerScenarios":"A Content-Type value that mime.ParseMediaType accepts yet contains no slash — essentially only possible via exotic or future MIME parser quirks; practically never observed in the wild.","commonSituations":"Almost none; occasionally reproduced by fuzzing or by clients that send non-standard header values that slip through lenient intermediaries.","solutions":["Set a standard type/subtype Content-Type such as text/caddyfile or application/json","Omit Content-Type to send raw JSON and bypass adaptation entirely"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// require a slash in the media type before calling the API\nmt, _, err := mime.ParseMediaType(ct)\nif err != nil || !strings.Contains(mt, \"/\") {\n    return fmt.Errorf(\"Content-Type must be type/subtype, got %q\", ct)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use standard MIME types; this branch is near-unreachable with well-formed headers"],"tags":["admin-api","http-headers","content-type","defensive-check"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}