lib/PublicInbox/HTTP.pm | 1 +
 t/httpd-corner.t        | 7 ++++++-

diff --git a/lib/PublicInbox/HTTP.pm b/lib/PublicInbox/HTTP.pm
index 0f4b5047784a75b5b9bba21797fbd6cc584851d5..18a1925066fbdbfabbed6ac54b60982a08f85db7 100644
--- a/lib/PublicInbox/HTTP.pm
+++ b/lib/PublicInbox/HTTP.pm
@@ -91,6 +91,7 @@ 			return quit($self, 400);
 		}
 		$self->do_read($rbuf, 8192, length($$rbuf)) or return;
 	}
+	return quit($self, 400) if grep(/\s/, keys %env); # stop smugglers
 	$$rbuf = substr($$rbuf, $r);
 	my $len = input_prepare($self, \%env) //
 		return write_err($self, undef); # EMFILE/ENFILE
diff --git a/t/httpd-corner.t b/t/httpd-corner.t
index cec754c9c13ae2a051a3586275c6a838838cf777..0a613a9e095565a5b4fa75fda023436532e200b6 100644
--- a/t/httpd-corner.t
+++ b/t/httpd-corner.t
@@ -82,7 +82,12 @@ 	chomp($body);
 	like($body, qr/\A[0-9]+\z/, '/pid response');
 	isnt($body, $pid, 'respawned worker');
 }
-
+{
+	my $conn = conn_for($sock, 'Header spaces bogus');
+	$conn->write("GET /empty HTTP/1.1\r\nSpaced-Out : 3\r\n\r\n");
+	$conn->read(my $buf, 4096);
+	like($buf, qr!\AHTTP/1\.[0-9] 400 !, 'got 400 response on bad request');
+}
 {
 	my $conn = conn_for($sock, 'streaming callback');
 	$conn->write("GET /callback HTTP/1.0\r\n\r\n");