zaproxy / zaproxy/zaproxy

Unable to connect to httpforever.com, natas0.natas.labs.overthewire.org due to ZAP's http header changes

Open
#9,428 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Describe the bug:

When trying to connect to a host that supports http but not https, ZAP immediately fails to connect with a "failed to respond" error.

This is consistently reproducible in core ZAP 2.17.0 with no add ons on MacOS 15.6.1 (M4 Silicon, arm64), also MacOS 16.6.1 (M3 Silicon, arm64).

This seems similar to https://github.com/zaproxy/zap-hud/issues/440 but occurs even with the HUD uninstalled.

Steps to reproduce the behavior:

Using core ZAP (all plugins uninstalled), put the below headers into Requester and click Send:

GET http://httpforever.com HTTP/1.1
host: httpforever.com
pragma: no-cache
cache-control: no-cache
Expected behavior:

Response should be displayed.

Software Versions:

ZAP
Version: 2.17.0

Installed Add-ons: [[id=automation, version=0.58.0],
[id=bruteforce, version=20.0.0], [id=callhome,
version=0.23.0], [id=commonlib, version=1.39.0], [id=domxss,
version=23.0.0], [id=encoder, version=1.8.0], [id=exim,
version=0.16.0], [id=fuzz, version=13.16.0], [id=graphql,
version=0.29.0], [id=insights, version=0.0.1], [id=network,
version=0.29.0], [id=openapi, version=48.0.0], [id=postman,
version=0.9.0], [id=replacer, version=21.0.0], [id=reports,
version=0.43.0], [id=requester, version=7.9.0], [id=retire,
version=0.52.0], [id=scanpolicies, version=0.7.0],
[id=selenium, version=15.43.0], [id=soap, version=29.0.0],
[id=spiderAjax, version=23.29.0], [id=webdrivermacos,
version=169.0.0], [id=websocket, version=35.0.0]]

Operating System: Mac OS X
Architecture: aarch64
CPU Cores: 10
Max Memory: 4 GB
Java Version: Eclipse Adoptium 17.0.17
System's Locale: en_US
Display Locale: en_GB
Format Locale: en_US
Default Charset: UTF-8
ZAP Home Directory: /Users/noamsturmwind/Library/Application Support/ZAP/
ZAP Installation Directory: /Users/noamsturmwind/Applications/ZAP.app/Contents/Java/./
Look and Feel: FlatLaf Light (com.formdev.flatlaf.FlatLightLaf)

Screenshots:
Image
Errors from the zap.log file:

Full debug logging uploaded as zap.log and pcap as zap.pcapng.gz.

Relevant log section:

2026-08-20 19:14:52,290 [Thread-4] DEBUG DefaultHttpClientConnectionOperator - httpforever.com:80 connecting null->httpforever.com/172.67.132.115:80 (60 SECONDS)
2026-08-20 19:14:52,290 [Thread-4] DEBUG ZapProxySelector - Selected proxies for socket://httpforever.com:80 [DIRECT]
2026-08-20 19:14:52,301 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 set socket timeout to 60 SECONDS
2026-08-20 19:14:52,302 [Thread-4] DEBUG DefaultHttpClientConnectionOperator - httpforever.com:80 connected null->httpforever.com/172.67.132.115:80 as http-outgoing-1
2026-08-20 19:14:52,302 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connected http-outgoing-1
2026-08-20 19:14:52,302 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 set socket timeout to 60 SECONDS
2026-08-20 19:14:52,302 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 endpoint connected
2026-08-20 19:14:52,302 [Thread-4] DEBUG MainClientExec - ex-0000000002 executing GET / HTTP/1.1
2026-08-20 19:14:52,302 [Thread-4] DEBUG ZapRequestAddCookies - ex-0000000002 Cookie spec selected: relaxed
2026-08-20 19:14:52,305 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 start execution ex-0000000002
2026-08-20 19:14:52,305 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 executing exchange ex-0000000002 over http-outgoing-1
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> GET / HTTP/1.1
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> host: httpforever.com
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> pragma: no-cache
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> cache-control: no-cache
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> content-length: 0
2026-08-20 19:14:52,305 [Thread-4] DEBUG wire - http-outgoing-1 >> "GET / HTTP/1.1[\r][\n]"
2026-08-20 19:14:52,305 [Thread-4] DEBUG wire - http-outgoing-1 >> "host: httpforever.com[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "pragma: no-cache[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "cache-control: no-cache[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "content-length: 0[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "[\r][\n]"
2026-08-20 19:14:52,322 [Thread-4] DEBUG wire - http-outgoing-1 << "end of stream"
2026-08-20 19:14:52,323 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 Close connection
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 endpoint closed
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 discarding endpoint
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 releasing endpoint
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connection is not kept alive
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connection released [route: {}->http://httpforever.com:80][total available: 1; route allocated: 0 of 1000; total allocated: 1 of 2000]
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapHttpRequestRetryExec - ex-0000000002 The target server failed to respond
org.apache.hc.core5.http.NoHttpResponseException: The target server failed to respond
        at org.apache.hc.core5.http.impl.io.DefaultBHttpClientConnection.receiveResponseHeader(DefaultBHttpClientConnection.java:301)
        at org.zaproxy.addon.network.internal.client.apachev5.ZapHttpRequestExecutor.execute(ZapHttpRequestExecutor.java:78)
        at org.apache.hc.core5.http.impl.io.HttpRequestExecutor.execute(HttpRequestExecutor.java:218)
        at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager$InternalConnectionEndpoint.execute(PoolingHttpClientConnectionManager.java:712)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.execute(InternalExecRuntime.java:216)
        at org.apache.hc.client5.http.impl.classic.MainClientExec.execute(MainClientExec.java:116)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:188)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapProtocolExec.execute(ZapProtocolExec.java:179)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapHttpRequestRetryExec.execute(ZapHttpRequestRetryExec.java:81)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapInternalHttpClient.doExecute(ZapInternalHttpClient.java:173)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl0(HttpSenderApache.java:486)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:365)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:116)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendRateLimited(BaseHttpSender.java:415)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:383)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:351)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:307)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:278)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:234)
        at org.parosproxy.paros.network.HttpSender.sendImpl(HttpSender.java:536)
        at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:529)
        at org.zaproxy.addon.requester.internal.HttpPanelSender.sendMessage(HttpPanelSender.java:130)
        at org.zaproxy.addon.requester.internal.ManualHttpRequestEditorPanel.sendMessage(ManualHttpRequestEditorPanel.java:333)
        at org.zaproxy.addon.requester.MessageEditorPanel.lambda$send$1(MessageEditorPanel.java:199)
        at java.base/java.lang.Thread.run(Unknown Source)
2026-08-20 19:14:52,324 [Thread-4] INFO  ZapHttpRequestRetryExec - Recoverable I/O exception (org.apache.hc.core5.http.NoHttpResponseException) caught when processing request to {}->http://httpforever.com:80
Additional context:

The same issue happens when using an active scan, as well as manual browsing launched from ZAP (Chrome and Firefox).

Would you like to help fix this issue?
  • Yes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Requester failure with the shown HTTP-only request and headers, then trace the send path through HttpPanelSender, BaseHttpSender, HttpSenderApache, and ZapHttpRequestExecutor. Compare the request/response handling around the reported NoHttpResponseException, and verify that the response is displayed for HTTP-only hosts without regressing active scans or browser traffic.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.