cloudflare / cloudflare/cloudflared

🐛 Tunnel returns 502 for requests whose host header contains a non-numeric port

Open
#1,490 0 comments 0 reactions 0 assignees View on GitHub
Priority: Normal Type: Bug
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

While running a tunnel I observed that any inbound HTTP/S request whose Host header ends in `:` (e.g. `app.example.com:aaaa`) is rejected by cloudflared with:

```
parse "...:aaaa/...": invalid port ":aaaa" after host
```

This aborts the request with a 502 response and writes the entire string verbatim to the logs.

**To Reproduce**

1. Run any current cloudflared tunnel:
2. From a client send a request with an alphabetic port in the host header:

```
curl -k "https://app.example.com/foo/bar" \
-H "Host: app.example.com:aaaa"
```

**Expected behavior**

The tunnel should either:
- strip / ignore the invalid port and continue, or
- return the default configured service code,
- and always sanitize untrusted input before logging.

**Logs and errors**

`2025-06-10T20:55:24Z ERR Request failed error="parse \"https://app.example.com:aaaa/foo/bar\": invalid port \":aaaa\" after host" connIndex=1 dest=https://app.example.com:aaaa/foo/bar event=0 ip=x.x.x.x type=http`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.