{"id":"e7f97e93bd3ac5a4","repo":"aio-libs/aiohttp","slug":"range-not-in-acceptable-format","errorCode":null,"errorMessage":"range not in acceptable format","messagePattern":"range not in acceptable format","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"warning","filePath":"aiohttp/web_request.py","lineNumber":613,"sourceCode":"        parsed = parse_cookie_header(self.headers.get(hdrs.COOKIE, \"\"))\n        # Extract values from Morsel objects\n        return MappingProxyType({name: morsel.value for name, morsel in parsed})\n\n    @reify\n    def http_range(self) -> \"slice[int, int, int]\":\n        \"\"\"The content of Range HTTP header.\n\n        Return a slice instance.\n\n        \"\"\"\n        rng = self._headers.get(hdrs.RANGE)\n        start, end = None, None\n        if rng is not None:\n            try:\n                pattern = r\"^bytes=(\\d*)-(\\d*)$\"\n                start, end = re.findall(pattern, rng, re.ASCII)[0]\n            except IndexError:  # pattern was not found in header\n                raise ValueError(\"range not in acceptable format\")\n\n            end = int(end) if end else None\n            start = int(start) if start else None\n\n            if start is None and end is not None:\n                # end with no start is to return tail of content\n                start = -end\n                end = None\n\n            if start is not None and end is not None:\n                # end is inclusive in range header, exclusive for slice\n                end += 1\n\n                if start >= end:\n                    raise ValueError(\"start cannot be after end\")\n\n            if start is end is None:  # No valid range supplied\n                raise ValueError(\"No start or end of range specified\")","sourceCodeStart":595,"sourceCodeEnd":631,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/web_request.py#L595-L631","documentation":"Raised as ValueError by BaseRequest.http_range (aiohttp/web_request.py:613) when the Range header is present but does not match the regex '^bytes=(\\d*)-(\\d*)$'. aiohttp only supports the RFC 7233 'bytes=' range unit; any other unit (e.g. 'items='), missing '=' , extra whitespace, or malformed syntax causes re.findall to return no groups and IndexError is caught and re-raised as this ValueError.","triggerScenarios":"Accessing request.http_range (directly or via FileResponse, which reads it implicitly) on a request whose Range header looks like 'items=0-10', 'bytes 0-10' (space instead of =), 'bytes=-', or '0-10' (missing 'bytes=' prefix).","commonSituations":"Custom clients sending non-standard range units; copy-pasted Range header from a different protocol (WebDAV, S3 partial-object); proxies that rewrite or corrupt Range; tests with manually crafted headers.","solutions":["Validate the Range header format before relying on request.http_range, returning HTTPRequestedRangeNotSatisfiable or HTTPBadRequest on parse failure.","Wrap request.http_range access in try/except ValueError and treat it as 'no range requested'.","Make sure clients send 'Range: bytes=start-end' exactly (lowercase 'bytes=' allowed, but the unit must be bytes)."],"exampleFix":"// before\nrng = request.http_range  # ValueError on bad header\n\n# after\ntry:\n    rng = request.http_range\nexcept ValueError:\n    raise web.HTTPBadRequest(text=\"Invalid Range header\")","handlingStrategy":"try-catch","validationCode":"import re\nrng = request.headers.get(\"Range\", \"\")\nif rng and not re.match(r\"^bytes=\\d*-\\d*$\", rng):\n    raise web.HTTPBadRequest(text=\"Invalid Range header\")","typeGuard":"def is_valid_range_header(value: str) -> bool:\n    import re\n    return bool(re.match(r\"^bytes=\\d*-\\d*$\", value))","tryCatchPattern":"try:\n    rng = request.http_range\nexcept ValueError:\n    raise web.HTTPBadRequest(text=\"Invalid Range header\")","preventionTips":["Validate Range header syntax before relying on request.http_range.","Let FileResponse handle Range natively if you only need partial-file serving.","Audit non-standard clients sending 'items=' or other range units."],"tags":["http","range","validation","header-parsing"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}