{"id":"ad5b6510269fa4e5","repo":"aio-libs/aiohttp","slug":"too-many-headers-received","errorCode":null,"errorMessage":"Too many headers received","messagePattern":"Too many headers received","errorType":"http","errorClass":"BadHttpMessage","httpStatus":400,"severity":"error","filePath":"aiohttp/http_parser.py","lineNumber":384,"sourceCode":"                    continue\n\n                if pos >= start_pos:\n                    if should_close:\n                        raise BadHttpMessage(\"Data after `Connection: close`\")\n\n                    # line found\n                    line = data[start_pos:pos]\n                    if SEP == b\"\\n\":  # For lax response parsing\n                        line = line.rstrip(b\"\\r\")\n                    if len(line) > max_line_length:\n                        raise LineTooLong(line[:100] + b\"...\", max_line_length)\n\n                    self._lines.append(line)\n                    # After processing the status/request line, everything is a header.\n                    max_line_length = self.max_field_size\n\n                    if len(self._lines) > self.max_headers:\n                        raise BadHttpMessage(\"Too many headers received\")\n\n                    start_pos = pos + len(SEP)\n\n                    # \\r\\n\\r\\n found\n                    if self._lines[-1] == EMPTY:\n                        max_trailers = self.max_headers - len(self._lines)\n                        try:\n                            msg: _MsgT = self.parse_message(self._lines)\n                        finally:\n                            self._lines.clear()\n\n                        def get_content_length() -> int | None:\n                            # payload length\n                            length_hdr = msg.headers.get(CONTENT_LENGTH)\n                            if length_hdr is None:\n                                return None\n\n                            # Shouldn't allow +/- or other number formats.","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/http_parser.py#L366-L402","documentation":"Raised by HttpParser.feed_data (aiohttp/http_parser.py:384) when the number of accumulated lines (request/status line plus every header line) exceeds max_headers (default 128). This is a memory-exhaustion / DoS guard: it caps how many header lines a single message can carry before the parser refuses.","triggerScenarios":"A request or response carrying more than 128 header lines (the count includes the leading request/status line). Triggered by header-flood traffic or, rarely, by a legitimate API that attaches dozens of custom headers.","commonSituations":"DoS/header-flood attacks; crawlers or SDKs that attach many trace/debug headers; legitimate but unusual APIs that exceed 128 distinct headers; or a client loop that accidentally stacks headers.","solutions":["Raise max_headers (server: Application request-parser kwargs) for routes that legitimately need more.","Reduce the number of headers your client sends; consolidate or drop redundant ones.","On the server, the default 128 returns 400 - monitor and tune per route if needed; rate-limit clients that flood headers."],"exampleFix":"# before - default max_headers (128) too low\napp = web.Application()\n# after - raise the cap for routes that need it\napp = web.Application(handler_args={'max_headers': 256})","handlingStrategy":"validation","validationCode":"MAX_OUTGOING_HEADERS = 128\ndef header_count_ok(headers) -> bool:\n    return len(headers) <= MAX_OUTGOING_HEADERS\nif not header_count_ok(outgoing):\n    raise ValueError(f'too many headers ({len(outgoing)})')","typeGuard":null,"tryCatchPattern":"from aiohttp import http_exceptions\ntry:\n    await request.read()\nexcept http_exceptions.BadHttpMessage as e:\n    if 'Too many headers' in str(e):\n        return web.Response(status=431)  # Request Header Fields Too Large\n    raise","preventionTips":["Keep the number of headers well under 128","Tune max_headers for routes that legitimately need more","Rate-limit clients that send header floods"],"tags":["http","limits","parser","dos","configuration"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}