{"id":"4d72e200bc582d7f","repo":"aio-libs/aiohttp","slug":"request-has-duplicate-chunked-transfer-encoding","errorCode":null,"errorMessage":"Request has duplicate `chunked` Transfer-Encoding","messagePattern":"Request has duplicate `chunked` Transfer-Encoding","errorType":"http","errorClass":"BadHttpMessage","httpStatus":400,"severity":"error","filePath":"aiohttp/http_parser.py","lineNumber":745,"sourceCode":"            path,\n            version_o,\n            headers,\n            raw_headers,\n            close,\n            compression,\n            upgrade,\n            chunked,\n            url,\n        )\n\n    def _is_chunked_te(self, te: str) -> bool:\n        # https://www.rfc-editor.org/rfc/rfc9112#section-7.1-3\n        # \"A sender MUST NOT apply the chunked transfer coding more\n        #  than once to a message body\"\n        parts = [p.strip(\" \\t\") for p in te.split(\",\")]\n        chunked_count = sum(1 for p in parts if p.isascii() and p.lower() == \"chunked\")\n        if chunked_count > 1:\n            raise BadHttpMessage(\"Request has duplicate `chunked` Transfer-Encoding\")\n        last = parts[-1]\n        # .lower() transforms some non-ascii chars, so must check first.\n        if last.isascii() and last.lower() == \"chunked\":\n            return True\n        # https://www.rfc-editor.org/rfc/rfc9112#section-6.3-2.4.3\n        raise BadHttpMessage(\"Request has invalid `Transfer-Encoding`\")\n\n\nclass HttpResponseParser(HttpParser[RawResponseMessage]):\n    \"\"\"Read response status line and headers.\n\n    BadStatusLine could be raised in case of any errors in status line.\n    Returns RawResponseMessage.\n    \"\"\"\n\n    protocol: \"ResponseHandler\"\n\n    # Lax mode should only be enabled on response parser.","sourceCodeStart":727,"sourceCodeEnd":763,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/http_parser.py#L727-L763","documentation":"Raised by HttpRequestParser._is_chunked_te (aiohttp/http_parser.py:745) when the Transfer-Encoding value, split on commas, contains 'chunked' more than once. RFC 9112 section 7.1 forbids applying the chunked coding more than once; doing so is a request-smuggling vector against parsers that deduplicate inconsistently. Request-parser specific (the response parser uses a looser check that does not count duplicates).","triggerScenarios":"A request with 'Transfer-Encoding: chunked, chunked' or any TE value where two or more comma-separated codings equal 'chunked'. Even 'gzip, chunked, chunked' triggers it.","commonSituations":"Request-smuggling attacks, proxies that append 'chunked' without deduplicating, or buggy encoders that stack the coding. Distinct from error 133 (TE+CL conflict) - here only TE is present but chunked is duplicated.","solutions":["Send 'Transfer-Encoding: chunked' exactly once, and only as the LAST coding in the list.","Fix any proxy that appends 'chunked' redundantly; deduplicate before forwarding.","Let aiohttp handle chunking automatically when you stream a body; do not set Transfer-Encoding manually."],"exampleFix":"# before - chunked listed twice\nheaders['Transfer-Encoding'] = 'chunked, chunked'\n# after - single chunked as the last coding\nheaders['Transfer-Encoding'] = 'chunked'\n# or just stream the body and let aiohttp add TE: chunked","handlingStrategy":"validation","validationCode":"def chunked_appears_once(te_value: str) -> bool:\n    parts = [p.strip().lower() for p in te_value.split(',')]\n    return parts.count('chunked') <= 1\nte = headers.get('Transfer-Encoding')\nif te is not None and not chunked_appears_once(te):\n    raise ValueError('duplicate chunked in Transfer-Encoding')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Send 'chunked' at most once and only as the final TE coding","Let the library manage chunked encoding when streaming a body","Strip duplicate chunked at every proxy hop"],"tags":["http","transfer-encoding","security","request-smuggling","parser","request"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}