For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cmcnicholas's avatar
cmcnicholas
Icon for Cirrus rankCirrus
Apr 04, 2024

Empty JSON payload blocked

I received a Support ID in which I can see the following error: "Malformed document. Document is too short : less than 2 bytes" I can see that there is no JSON in the payload which makes sense....
application delivery
security
Lucas_Thompson's avatar
Lucas_Thompson
Icon for Employee rankEmployee
Apr 05, 2024

It seems like this error can occur during parsing of http chunk mode transfer-encoding where it thinks the payload should be JSON or XML with JSON inside it, but the chunk is malformed. Like maybe it doesn't have the correct CR/LF sequence or is missing a chunk-size header. 

BIG-IP also had a long standing problem/bug with HTTP content that was both compressed and chunked, and this may be some side effect of that issue. It generally caused the chunk-size headers to be duplicated, but only when using certain kinds of profiles. This would cause random numbers to appear in the processed HTTP messages, and could definitely throw off the parser. You may want to try to reconfigure the HTTP profile you're using to Rechunk the request or response instead of Sustain.

If that doesn't have any effect, it may indicate that some clients aren't sending valid HTTP messages. You could spot this in a (decrypted) packet capture by carefully comparing what you see to the specification.