valyala/fasthttp · error

malformed mime header line

Error message

malformed mime header line: %q

What it means

The MIME header scanner (headerscanner.next) validates each header key with isValidHeaderKey; keys containing illegal bytes or interior spaces make the whole line invalid, so scanning stops with this error and the connection is closed by callers (parseHeaders, parseTrailer).

Solutions

1. Fix the producer to send RFC-compliant header names (token characters only, no spaces).
2. Sanitize dynamically built header names before writing them to the wire.
3. Drop/normalize malformed lines at an upstream gateway before fasthttp parses them.
4. Capture raw traffic to identify exactly which line fails and who sent it.

Example fix

// before
X My Header: value
// after
X-My-Header: value

func isValidKey(k string) bool {
    if len(k) == 0 { return false }
    for i := 0; i < len(k); i++ {
        b := k[i]
        if b <= ' ' || b >= 0x7f { return false }
    }
    return true
} // mirrors isValidHeaderKey used by the scanner

if !s.next() && s.err != nil && strings.Contains(s.err.Error(), "malformed mime header line") {
    // abort parse, respond 400
}

When it happens

Trigger: A header line whose key contains spaces or illegal characters, e.g. 'Bad Key: value' or 'X(1): value', encountered while parsing headers or trailers.

Common situations: HTTP request smuggling probes; broken embedded-device HTTP stacks; headers corrupted by manual socket writes or faulty serialization in upstream services.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• malformed mime header: missing colon
• byte range is invalid for empty content
• cannot find whitespace in the first line of response
• cannot gunzip request body
• cannot parse content-length

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/c86f3cf7b7b94283. Report an issue: GitHub.

Appendix: source

Thrown at headerscanner.go:69

		if len(s.b) > 0 && (s.b[0] == ' ' || s.b[0] == '\t') {
			s.err = errors.New("invalid headers, headers cannot start with space or tab")
			return false
		}

		s.initialized = true
	}

	kv, colon, err := s.readContinuedLineSlice()
	if len(kv) == 0 {
		s.err = err
		return false
	}

	// Key ends at the first colon, already found by readContinuedLineSlice.
	k, v := kv[:colon], kv[colon+1:]
	valid, innerSpace := isValidHeaderKey(k)
	if !valid {
		s.err = fmt.Errorf("malformed mime header line: %q", kv)
		return false
	}
	s.keyHasSpace = innerSpace

	// Skip initial spaces in value, without bytes.TrimLeft: it would
	// rebuild its ASCII set on every call.
	for len(v) > 0 && (v[0] == ' ' || v[0] == '\t') {
		v = v[1:]
	}

	s.key = k
	s.value = v

	if err != nil {
		s.err = err
		return false
	}

View on GitHub (pinned to c96f600972)