ValueError: Newline or carriage return detected in headers with audiobookshelf

[sven-probst]

What version of Music Assistant has the issue?

2.7.6

How is the MA server installed?

Docker Container

Mandatory: Carefully read the Troubleshooting FAQ and confirm that

• I have examined the logs and tried to resolve this issue
• I have fixed any errors in the logs that relate to tags
• I am not running MA across a VPN, VLAN, subnet, behind a firewall, or using local SSL or have any other complex network setup
• I am not using or have disabled tools such as AdGuard, Pi-hole or pfSense and retested
• I have checked my network setup to ensure mDNS/multicast is not being blocked
• I have reviewed the Open and Closed Issues and Discussions to resolve this yourself?
• I have reviewed the applicable player or music provider documentation
• I have reviewed the MA Status Page
• I have tried restarting MA and rebooting the host

As Applicable: Carefully read the Troubleshooting FAQ and confirm that

• If using HA, I have confirmed the internal URL is set correctly
• I have tried a wired connection for issues related to interrupted or poor playback quality
• If the problem relates to a device then I have checked the device settings
• If it is a frontend issue, I have tried a different widely used browser
• For voice problems, I have sought help elsewhere before returning here
• For playback problems, I have recycled power to the physical device

The problem

Trying to play an episode of https://feeds.castos.com/3n6p that is imported in audiobookshelf and visible trough the audiobookshelf provider ends in
2026-02-07 17:48:50.503 ERROR (MainThread) [aiohttp.server] Error handling request from 192.168.0.12 Traceback (most recent call last): File "/app/venv/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 510, in _handle_request resp = await request_handler(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/aiohttp/web_app.py", line 569, in _handle return await handler(request) ^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/music_assistant/controllers/streams/streams_controller.py", line 468, in serve_queue_item_stream await resp.prepare(request) File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 460, in prepare return await self._start(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 468, in _start await self._write_headers() File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 545, in _write_headers await writer.write_headers(status_line, self._headers) File "/app/venv/lib/python3.13/site-packages/aiohttp/http_writer.py", line 217, in write_headers buf = _serialize_headers(status_line, headers) File "aiohttp/_http_writer.pyx", line 148, in aiohttp._http_writer._serialize_headers File "aiohttp/_http_writer.pyx", line 115, in aiohttp._http_writer._write_str_raise_on_nlcr ValueError: Newline or carriage return detected in headers. Potential header injection attack.

Playback does not start after that error. occurs.

The episode-title contains some newline and/or leading/trailing whitespaces. Removing the whitespaces in audiobookshelf episode title manually fixes that error. Maybe the title could be sanitized in the audiobookshelf provider while import?

How to reproduce

try to play an episode of https://feeds.castos.com/3n6p via the audiobookshelf provider.

Music Providers

audiobookshelf

Player Providers

squeezelite

Full log output

2026-02-07 17:48:50.503 ERROR (MainThread) [aiohttp.server] Error handling request from 192.168.0.12 Traceback (most recent call last): File "/app/venv/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 510, in _handle_request resp = await request_handler(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/aiohttp/web_app.py", line 569, in _handle return await handler(request) ^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/music_assistant/controllers/streams/streams_controller.py", line 468, in serve_queue_item_stream await resp.prepare(request) File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 460, in prepare return await self._start(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 468, in _start await self._write_headers() File "/app/venv/lib/python3.13/site-packages/aiohttp/web_response.py", line 545, in _write_headers await writer.write_headers(status_line, self._headers) File "/app/venv/lib/python3.13/site-packages/aiohttp/http_writer.py", line 217, in write_headers buf = _serialize_headers(status_line, headers) File "aiohttp/_http_writer.pyx", line 148, in aiohttp._http_writer._serialize_headers File "aiohttp/_http_writer.pyx", line 115, in aiohttp._http_writer._write_str_raise_on_nlcr ValueError: Newline or carriage return detected in headers. Potential header injection attack.

Additional information

https://feeds.castos.com/3n6p via audiobookshelf

What version of Home Assistant Core (if used) are your running

2026.2.1

What type of installation are you running?

Home Assistant Container

On what type of hardware are you running?

Generic x86-64 (e.g. Intel NUC)

Have you included ALL of the information specified in the Troubleshooting FAQ or explained why you cannot

• Yes

[github-actions]

⚠️ Issue Template Validation

Thank you for reporting this issue! However, there are some problems with the issue template:

• Please ATTACH the log file instead of pasting it. See instructions in the template.

Please update your issue with the missing information. Providing complete information helps us resolve issues faster. See the Troubleshooting Guide for more details.

[sven-probst]

container.log

[OzGav]

@fmunkes

[fmunkes]

Interesting find, thank you. I opened a PR against core rather than fixing it only for ABS. Should your player support queue_flow_mode , you could potentially use that as a workaround until that is merged.

Fix will be in next beta, and will be backported to stable too.

[sven-probst]

Tested with 2.8.0.dev2026021005 -> problem is fixed. Thank you!