cloudflare / cloudflare/cloudflared
🐛 Tunnel returns 502 for requests whose host header contains a non-numeric port
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
While running a tunnel I observed that any inbound HTTP/S request whose Host header ends in `:` (e.g. `app.example.com:aaaa`) is rejected by cloudflared with:
```
parse "...:aaaa/...": invalid port ":aaaa" after host
```
This aborts the request with a 502 response and writes the entire string verbatim to the logs.
**To Reproduce**
1. Run any current cloudflared tunnel:
2. From a client send a request with an alphabetic port in the host header:
```
curl -k "https://app.example.com/foo/bar" \
-H "Host: app.example.com:aaaa"
```
**Expected behavior**
The tunnel should either:
- strip / ignore the invalid port and continue, or
- return the default configured service code,
- and always sanitize untrusted input before logging.
**Logs and errors**
`2025-06-10T20:55:24Z ERR Request failed error="parse \"https://app.example.com:aaaa/foo/bar\": invalid port \":aaaa\" after host" connIndex=1 dest=https://app.example.com:aaaa/foo/bar event=0 ip=x.x.x.x type=http`
Contributor guide
Assessment
This issue has not been assessed yet.