Baike.dev
Log in
Back to tool/Back to issues
#9428·OWASP ZAP

Unable to connect to httpforever.com, natas0.natas.labs.overthewire.org due to ZAP's http header changes

Author: nsturmwindCreated Aug 20, 2026Updated Sep 15, 2026

Describe the bug:

When trying to connect to a host that supports http but not https, ZAP immediately fails to connect with a "failed to respond" error.

This is consistently reproducible in core ZAP 2.17.0 with no add ons on MacOS 15.6.1 (M4 Silicon, arm64), also MacOS 16.6.1 (M3 Silicon, arm64).

This seems similar to https://github.com/zaproxy/zap-hud/issues/440 but occurs even with the HUD uninstalled.

Steps to reproduce the behavior:

Using core ZAP (all plugins uninstalled), put the below headers into Requester and click Send:

GET http://httpforever.com HTTP/1.1
host: httpforever.com
pragma: no-cache
cache-control: no-cache

Expected behavior:

Response should be displayed.

Software Versions:

ZAP Version: 2.17.0

Installed Add-ons: [[id=automation, version=0.58.0], [id=bruteforce, version=20.0.0], [id=callhome, version=0.23.0], [id=commonlib, version=1.39.0], [id=domxss, version=23.0.0], [id=encoder, version=1.8.0], [id=exim, version=0.16.0], [id=fuzz, version=13.16.0], [id=graphql, version=0.29.0], [id=insights, version=0.0.1], [id=network, version=0.29.0], [id=openapi, version=48.0.0], [id=postman, version=0.9.0], [id=replacer, version=21.0.0], [id=reports, version=0.43.0], [id=requester, version=7.9.0], [id=retire, version=0.52.0], [id=scanpolicies, version=0.7.0], [id=selenium, version=15.43.0], [id=soap, version=29.0.0], [id=spiderAjax, version=23.29.0], [id=webdrivermacos, version=169.0.0], [id=websocket, version=35.0.0]]

Operating System: Mac OS X Architecture: aarch64 CPU Cores: 10 Max Memory: 4 GB Java Version: Eclipse Adoptium 17.0.17 System's Locale: en_US Display Locale: en_GB Format Locale: en_US Default Charset: UTF-8 ZAP Home Directory: /Users/noamsturmwind/Library/Application Support/ZAP/ ZAP Installation Directory: /Users/noamsturmwind/Applications/ZAP.app/Contents/Java/./ Look and Feel: FlatLaf Light (com.formdev.flatlaf.FlatLightLaf)

Screenshots:

Image

Errors from the zap.log file:

Full debug logging uploaded as zap.log and pcap as zap.pcapng.gz.

Relevant log section:

2026-08-20 19:14:52,290 [Thread-4] DEBUG DefaultHttpClientConnectionOperator - httpforever.com:80 connecting null->httpforever.com/172.67.132.115:80 (60 SECONDS)
2026-08-20 19:14:52,290 [Thread-4] DEBUG ZapProxySelector - Selected proxies for socket://httpforever.com:80 [DIRECT]
2026-08-20 19:14:52,301 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 set socket timeout to 60 SECONDS
2026-08-20 19:14:52,302 [Thread-4] DEBUG DefaultHttpClientConnectionOperator - httpforever.com:80 connected null->httpforever.com/172.67.132.115:80 as http-outgoing-1
2026-08-20 19:14:52,302 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connected http-outgoing-1
2026-08-20 19:14:52,302 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 set socket timeout to 60 SECONDS
2026-08-20 19:14:52,302 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 endpoint connected
2026-08-20 19:14:52,302 [Thread-4] DEBUG MainClientExec - ex-0000000002 executing GET / HTTP/1.1
2026-08-20 19:14:52,302 [Thread-4] DEBUG ZapRequestAddCookies - ex-0000000002 Cookie spec selected: relaxed
2026-08-20 19:14:52,305 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 start execution ex-0000000002
2026-08-20 19:14:52,305 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 executing exchange ex-0000000002 over http-outgoing-1
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> GET / HTTP/1.1
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> host: httpforever.com
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> pragma: no-cache
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> cache-control: no-cache
2026-08-20 19:14:52,305 [Thread-4] DEBUG headers - http-outgoing-1 >> content-length: 0
2026-08-20 19:14:52,305 [Thread-4] DEBUG wire - http-outgoing-1 >> "GET / HTTP/1.1[\r][\n]"
2026-08-20 19:14:52,305 [Thread-4] DEBUG wire - http-outgoing-1 >> "host: httpforever.com[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "pragma: no-cache[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "cache-control: no-cache[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "content-length: 0[\r][\n]"
2026-08-20 19:14:52,306 [Thread-4] DEBUG wire - http-outgoing-1 >> "[\r][\n]"
2026-08-20 19:14:52,322 [Thread-4] DEBUG wire - http-outgoing-1 << "end of stream"
2026-08-20 19:14:52,323 [Thread-4] DEBUG DefaultManagedHttpClientConnection - http-outgoing-1 Close connection
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 endpoint closed
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapInternalHttpClient - ep-0000000002 discarding endpoint
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 releasing endpoint
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connection is not kept alive
2026-08-20 19:14:52,324 [Thread-4] DEBUG PoolingHttpClientConnectionManager - ep-0000000002 connection released [route: {}->http://httpforever.com:80][total available: 1; route allocated: 0 of 1000; total allocated: 1 of 2000]
2026-08-20 19:14:52,324 [Thread-4] DEBUG ZapHttpRequestRetryExec - ex-0000000002 The target server failed to respond
org.apache.hc.core5.http.NoHttpResponseException: The target server failed to respond
        at org.apache.hc.core5.http.impl.io.DefaultBHttpClientConnection.receiveResponseHeader(DefaultBHttpClientConnection.java:301)
        at org.zaproxy.addon.network.internal.client.apachev5.ZapHttpRequestExecutor.execute(ZapHttpRequestExecutor.java:78)
        at org.apache.hc.core5.http.impl.io.HttpRequestExecutor.execute(HttpRequestExecutor.java:218)
        at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager$InternalConnectionEndpoint.execute(PoolingHttpClientConnectionManager.java:712)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.execute(InternalExecRuntime.java:216)
        at org.apache.hc.client5.http.impl.classic.MainClientExec.execute(MainClientExec.java:116)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:188)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapProtocolExec.execute(ZapProtocolExec.java:179)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapHttpRequestRetryExec.execute(ZapHttpRequestRetryExec.java:81)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ZapInternalHttpClient.doExecute(ZapInternalHttpClient.java:173)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl0(HttpSenderApache.java:486)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:365)
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:116)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendRateLimited(BaseHttpSender.java:415)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:383)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:351)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:307)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:278)
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:234)
        at org.parosproxy.paros.network.HttpSender.sendImpl(HttpSender.java:536)
        at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:529)
        at org.zaproxy.addon.requester.internal.HttpPanelSender.sendMessage(HttpPanelSender.java:130)
        at org.zaproxy.addon.requester.internal.ManualHttpRequestEditorPanel.sendMessage(ManualHttpRequestEditorPanel.java:333)
        at org.zaproxy.addon.requester.MessageEditorPanel.lambda$send$1(MessageEditorPanel.java:199)
        at java.base/java.lang.Thread.run(Unknown Source)
2026-08-20 19:14:52,324 [Thread-4] INFO  ZapHttpRequestRetryExec - Recoverable I/O exception (org.apache.hc.core5.http.NoHttpResponseException) caught when processing request to {}->http://httpforever.com:80

Additional context:

The same issue happens when using an active scan, as well as manual browsing launched from ZAP (Chrome and Firefox).

Would you like to help fix this issue?

  • Yes

Source: zaproxy/zaproxy

View original on GitHubView discussion on GitHub