ffuf/ffuf · error

malformed request supplied

Error message

malformed request supplied

What it means

The first line of a raw HTTP request must contain at least three space-separated tokens: METHOD, PATH, and PROTOCOL (e.g. 'GET /dir/FUZZ HTTP/1.1'). parseRawRequest splits the request line on spaces and returns this error if fewer than 3 parts result, because it cannot determine the method and target.

Source

Thrown at pkg/ffuf/optionsparser.go:746

func parseRawRequest(parseOpts *ConfigOptions, conf *Config) error {
	conf.RequestFile = parseOpts.Input.Request
	conf.RequestProto = parseOpts.Input.RequestProto
	file, err := os.Open(parseOpts.Input.Request)
	if err != nil {
		return fmt.Errorf("could not open request file: %s", err)
	}
	defer file.Close()

	r := bufio.NewReader(file)

	s, err := r.ReadString('\n')
	if err != nil {
		return fmt.Errorf("could not read request: %s", err)
	}
	parts := strings.Split(s, " ")
	if len(parts) < 3 {
		return fmt.Errorf("malformed request supplied")
	}
	// Set the request Method
	conf.Method = parts[0]

	for {
		line, err := r.ReadString('\n')
		line = strings.TrimSpace(line)

		if err != nil || line == "" {
			break
		}

		p := strings.SplitN(line, ":", 2)
		if len(p) != 2 {
			continue
		}

		if strings.EqualFold(p[0], "content-length") {

View on GitHub (pinned to 33c67d28c8)

Solutions

1. Make the first line a full request line: 'METHOD /path HTTP/1.1'
2. Re-export the raw request from the proxy tool instead of hand-editing
3. Check for lost characters from copy-paste (the HTTP/1.1 suffix)
4. Verify no encoding issue collapsed the spaces in the line

Example fix

// before (req.txt first line)
GET /dir/FUZZ
// after
GET /dir/FUZZ HTTP/1.1
Host: example.com

f, _ := os.Open(opts.Input.Request)
first, _ := bufio.NewReader(f).ReadString('\n')
f.Close()
if len(strings.Fields(first)) < 3 {
    return fmt.Errorf("request line %q must be 'METHOD /path HTTP/1.1'", strings.TrimSpace(first))
}

When it happens

Trigger: ConfigFromOptions -> parseRawRequest when the request line has fewer than 3 space-separated parts — e.g. 'GET /path' (missing HTTP version), a stray 'GET' alone, or a line of garbage that happens to read successfully.

Common situations: Hand-edited request files that dropped the HTTP version token; HTTP/2-style pseudo request lines ('GET /path' without version); files saved with only headers; copy-paste losing the protocol suffix due to line wrapping.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Could not parse raw request: %s
• could not read request: %s
• could not parse request URL: %s
• preflight: malformed request line in %q
• %s value %q must be "NAME:regex" with a non-empty name and r

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/2b7ab5b0de32d07a. Report an issue: GitHub.