projectdiscovery/nuclei · error

could not rebuild request URL

Error message

could not rebuild request URL

What it means

Sentinel error from the shared HTTP client pool. It is returned (wrapped together with the underlying parse error) by checkMaxRedirects: while following a redirect, if the new request URL is not already URL-encoded, nuclei re-parses it with urlutil.Parse (fix for issue #5900); a parse failure aborts the redirect chain with ErrRebuildURL. So the real cause is a redirect Location (or original URL) that Go's URL parser cannot handle.

Source

Thrown at pkg/protocols/http/httpclientpool/errors.go:6

package httpclientpool

import "errors"

var (
	ErrRebuildURL = errors.New("could not rebuild request URL")
)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Inspect the wrapped error chain — errors.Is(err, httpclientpool.ErrRebuildURL) plus the inner parse error names the bad URL
2. If you control the server/redirector, percent-encode the Location URL properly
3. Otherwise exclude or manually investigate the offending target; the failure is server-side data, not a nuclei bug
4. Keep nuclei updated: URL-rebuild handling in redirects has been progressively hardened

if u, err := urlutil.Parse(targetURL); err != nil {
    // unparseable URL will fail earlier anyway; skip before scanning
    return fmt.Errorf("skipping target with unparseable URL: %w", err)
}

if err := doRequest(); err != nil {
    if errors.Is(err, httpclientpool.ErrRebuildURL) {
        // server emitted an unparseable redirect URL — log and skip this target
        gologger.Warning().Msgf("bad redirect URL on %s: %v", target, err)
        return nil
    }
    return err
}

When it happens

Trigger: A target server redirects to a Location header containing unparseable content — raw spaces, invalid percent-encoding (e.g. '%' not followed by hex), malformed IPv6 literal — or a proxy rewrites Location into something invalid. Nuclei then fails that request with this wrapped error.

Common situations: Misconfigured redirectors and short-link services emitting unencoded URLs; WAFs/proxies mangling Location headers; legacy apps with spaces in paths.

Related errors

• probe concurrency must be at least 1
• response read size must be non-negative
• empty filename
• cannot use unsafe with http fuzzing templates
• Invalid HTTP method verb: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0e7dd3ceeee09ac0. Report an issue: GitHub.