{"id":"000c1413b161d1e3","repo":"actix/actix-web","slug":"invalid-chunk-size-line-size-is-too-big","errorCode":null,"errorMessage":"Invalid chunk size line: Size is too big","messagePattern":"Invalid chunk size line: Size is too big","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"actix-http/src/h1/chunked.rs","lineNumber":81,"sourceCode":"            b'\\r' => return Poll::Ready(Ok(ChunkedState::SizeLf)),\n            _ => {\n                return Poll::Ready(Err(io::Error::new(\n                    io::ErrorKind::InvalidInput,\n                    \"Invalid chunk size line: Invalid Size\",\n                )));\n            }\n        };\n\n        match size.checked_mul(radix) {\n            Some(n) => {\n                *size = n;\n                *size += rem as u64;\n\n                Poll::Ready(Ok(ChunkedState::Size))\n            }\n            None => {\n                debug!(\"chunk size would overflow u64\");\n                Poll::Ready(Err(io::Error::new(\n                    io::ErrorKind::InvalidInput,\n                    \"Invalid chunk size line: Size is too big\",\n                )))\n            }\n        }\n    }\n\n    fn read_size_lws(rdr: &mut BytesMut) -> Poll<Result<ChunkedState, io::Error>> {\n        match byte!(rdr) {\n            // LWS can follow the chunk size, but no more digits can come\n            b'\\t' | b' ' => Poll::Ready(Ok(ChunkedState::SizeLws)),\n            b';' => Poll::Ready(Ok(ChunkedState::Extension)),\n            b'\\r' => Poll::Ready(Ok(ChunkedState::SizeLf)),\n            _ => Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidInput,\n                \"Invalid chunk size linear white space\",\n            ))),\n        }","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/actix/actix-web/blob/937960ca67f20e14ffe2a075bf6d4593502be12c/actix-http/src/h1/chunked.rs#L63-L99","documentation":"io::Error(InvalidInput, \"Invalid chunk size line: Size is too big\") (chunked.rs:81-84) is returned when read_size's checked_mul overflows u64 while accumulating hex digits — i.e. the declared chunk size is astronomically large (> 2^64). The unit test hrs_chunk_size_overflow (chunked.rs:407-426) reproduces it with 'f0000000000000003'.","triggerScenarios":"A chunked body declares a size field whose hex value exceeds u64::MAX (e.g. 'f0000000000000003'). This is almost always a malicious or malformed payload intended to exhaust the parser.","commonSituations":"HTTP Request Smuggling / parser-stress fuzzing, or a corrupt size field from a broken encoder.","solutions":["Reject the request at the edge; the peer is sending an impossible chunk size.","Configure payload size limits (PayloadConfig) so oversized bodies are rejected before this point where possible.","Ensure any reverse proxy normalises/validates Transfer-Encoding."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Treat oversized/overflowing chunk sizes as a bad request.\nuse actix_http::error::PayloadError;\nmatch payload.next().await {\n    Some(Err(PayloadError::Io(e))) if e.kind() == io::ErrorKind::InvalidInput => {\n        return HttpResponse::BadRequest().finish(); // likely malicious\n    }\n    _ => {}\n}","preventionTips":["Set a PayloadConfig max-body limit so oversized bodies are rejected early.","Normalise Transfer-Encoding at a front proxy and reject suspicious encodings.","Treat size-overflow chunked bodies as attack traffic."],"tags":["http","transfer-encoding","chunked","actix-http","security"],"analyzedSha":"937960ca67f20e14ffe2a075bf6d4593502be12c","analyzedAt":"2026-08-06T01:15:46.978Z","schemaVersion":2}