projectdiscovery/nuclei · error

invalid header line: %s

Error message

invalid header line: %s

What it means

A header line inside the header block has no ':' separator or an empty key. After strings.Cut(line, ':'), either found==false (no colon at all) or key=='' (line starts with ':' or spaces before colon). 'Host:' is handled specially before this check and routed into URL.Host.

Source

Thrown at pkg/input/types/http.go:275

	if err != nil {
		return nil, fmt.Errorf("failed to parse url: %s", err)
	}
	rr.URL = *urlx

	// parse headers
	rr.Request.Headers = mapsutil.NewOrderedMap[string, string]()
	for {
		line, err := protoReader.ReadLine()
		if err != nil {
			return nil, fmt.Errorf("failed to read header line: %s", err)
		}
		if line == "" {
			// end of headers next is body
			break
		}
		key, value, found := strings.Cut(line, ":")
		if !found || key == "" {
			return nil, fmt.Errorf("invalid header line: %s", line)
		}
		value = strings.TrimSpace(value)
		// Host carries the authority rather than request metadata, and callers
		// read it off the URL: retryablehttp derives the wire Host from there,
		// and keeping it in the header map would expose it to header fuzzing as
		// if it were an ordinary header.
		if strings.EqualFold(key, "Host") {
			// an absolute request target takes precedence over the Host header
			if rr.URL.Host == "" {
				rr.URL.Host = value
			}
			continue
		}
		rr.Request.Headers.Set(key, value)
	}

	// parse body
	rr.Request.Body = ""

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Format every header as 'Name: value' with a colon
2. Put long header values on a single line (line folding is not supported)
3. If the failing line looks like body content, add the blank line above it to end the header block

Example fix

# before
  Accept-Encoding gzip

# after
  Accept-Encoding: gzip

for _, line := range headerLines {
    if line == "" { break }
    key, _, found := strings.Cut(line, ":")
    if !found || strings.TrimSpace(key) == "" {
        return fmt.Errorf("malformed header line: %q", line)
    }
}

Catch, report the exact offending line (it is included in the message), fix the colon, and re-parse.

When it happens

Trigger: Lines like 'Accept-Encoding gzip' (missing colon), ': value' (empty key), continuation/obsolete line folding lines starting with spaces, or a body line parsed as header because the blank separator line was misplaced.

Common situations: Manually editing headers and dropping colons; pasted multi-line header values (obs-fold) which this parser rejects; header names containing spaces.

Related errors

• failed to read method line: %s
• invalid method line: %s
• failed to parse url: %s
• failed to read header line: %s
• missing url in request response

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/0d0ee84845f418d0. Report an issue: GitHub.