Jump to solution
Verify

The Fix

pip install requests==2.27.0

Based on closed psf/requests issue #2725 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit
@@ -315,6 +315,15 @@ file-like object for your body:: requests.post('http://some.url/streamed', data=f) +.. warning:: It is strongly recommended that you open files in `binary mode`_. + This is because Requests may attempt to provide the + ``Content-Length`` header for you, and if it does this value will
repro.py
Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource logRequest INFO: rmeta (multipart/form-data;boundary=d764925698424d719281a56941edb9b7) Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource parse WARNING: rmeta: Text extraction failed org.apache.tika.exception.TikaException: Unexpected RuntimeException from org.apache.tika.server.resource.TikaResource$1@8a9107e at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:283) at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:120) at org.apache.tika.parser.RecursiveParserWrapper.parse(RecursiveParserWrapper.java:159) at org.apache.tika.server.resource.TikaResource.parse(TikaResource.java:244) at org.apache.tika.server.resource.RecursiveMetadataResource.parseMetadata(RecursiveMetadataResource.java:86) at org.apache.tika.server.resource.RecursiveMetadataResource.getMetadata(RecursiveMetadataResource.java:68) at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181) at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:99) at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59) at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96) at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:251) at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:261) at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:70) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1088) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1024) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135) at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116) at org.eclipse.jetty.server.Server.handle(Server.java:370) at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:494) at org.eclipse.jetty.server.AbstractHttpConnection.content(AbstractHttpConnection.java:982) at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:1043) at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:865) at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:240) at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82) at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:696) at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608) at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java: ... (truncated) ...
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install requests==2.27.0\nWhen NOT to use: This fix is not applicable if files are intentionally opened in text mode for specific use cases.\n\n

Why This Fix Works in Production

  • Trigger: Aug 14, 2015 7:32:38 PM org.apache.tika.server.resource.TikaResource parse
  • Mechanism: The issue arises from using text mode to open files, leading to incorrect content-length calculations
  • Why the fix works: Added warnings about opening files in text mode, which may lead to incorrect content-length in requests. (first fixed release: 2.27.0).
Production impact:
  • If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

  • Shows up under Python 2.7.9 in real deployments (not just unit tests).
  • The issue arises from using text mode to open files, leading to incorrect content-length calculations
  • Surfaces as: Aug 14, 2015 7:32:38 PM org.apache.tika.server.resource.TikaResource parse

Proof / Evidence

  • GitHub issue: #2725
  • Fix PR: https://github.com/psf/requests/pull/2825
  • First fixed release: 2.27.0
  • Reproduced locally: No (not executed)
  • Last verified: 2026-02-07
  • Confidence: 0.95
  • Did this fix it?: Yes (upstream fix exists)
  • Own content ratio: 0.24

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

“Here's what I'm seeing on the Tika server end: And then on the requests end: <img width="525" alt="screen shot 2015-08-14 at 8 09 23 pm"…”
@chrismattmann · 2015-08-15 · source
“note this is all occurring using localhost. System env info: Tika Server - Tried with JDK 1.8, and also with JDK 1.7. Tika Python 1.9.10…”
@chrismattmann · 2015-08-15 · source
“Another interesting note”
@chrismattmann · 2015-08-15 · source
“If you want to test sending larger chunks (by forcing httplib to send what it reads) you could tinker with https://github.com/sigmavirus24/requests-toolbelt/pull/84/files to wrap your file…”
@sigmavirus24 · 2015-08-15 · source

Failure Signature (Search String)

  • Aug 14, 2015 7:32:38 PM org.apache.tika.server.resource.TikaResource parse

Error Message

Stack trace
error.txt
Error Message ------------- Aug 14, 2015 7:32:38 PM org.apache.tika.server.resource.TikaResource parse WARNING: rmeta: Text extraction failed org.apache.tika.io.TaggedIOException: timeout at org.apache.tika.io.TaggedInputStream.handleIOException(TaggedInputStream.java:133) at org.apache.tika.io.ProxyInputStream.read(ProxyInputStream.java:103) at org.apache.tika.io.TikaInputStream.peek(TikaInputStream.java:489) at org.apache.tika.parser.pkg.ZipContainerDetector.detect(ZipContainerDetector.java:83) at org.apache.tika.detect.CompositeDetector.detect(CompositeDetector.java:61) at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:112) at org.apache.tika.parser.RecursiveParserWrapper.parse(RecursiveParserWrapper.java:159) at org.apache.tika.server.resource.TikaResource.parse(TikaResource.java:244) at org.apache.tika.server.resource.RecursiveMetadataResource.parseMetadata(RecursiveMetadataResource.java:86) at org.apache.tika.server.resource.RecursiveMetadataResource.getMetadata(RecursiveMetadataResource.java:68) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.j ... (truncated) ...
Stack trace
error.txt
Error Message ------------- Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource logRequest INFO: rmeta (multipart/form-data;boundary=d764925698424d719281a56941edb9b7) Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource parse WARNING: rmeta: Text extraction failed org.apache.tika.exception.TikaException: Unexpected RuntimeException from org.apache.tika.server.resource.TikaResource$1@8a9107e at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:283) at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:120) at org.apache.tika.parser.RecursiveParserWrapper.parse(RecursiveParserWrapper.java:159) at org.apache.tika.server.resource.TikaResource.parse(TikaResource.java:244) at org.apache.tika.server.resource.RecursiveMetadataResource.parseMetadata(RecursiveMetadataResource.java:86) at org.apache.tika.server.resource.RecursiveMetadataResource.getMetadata(RecursiveMetadataResource.java:68) at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181) at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:2 ... (truncated) ...
Stack trace
error.txt
Error Message ------------- org.apache.tika.io.TaggedIOException: timeout

Minimal Reproduction

repro.py
Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource logRequest INFO: rmeta (multipart/form-data;boundary=d764925698424d719281a56941edb9b7) Aug 14, 2015 7:55:44 PM org.apache.tika.server.resource.TikaResource parse WARNING: rmeta: Text extraction failed org.apache.tika.exception.TikaException: Unexpected RuntimeException from org.apache.tika.server.resource.TikaResource$1@8a9107e at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:283) at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:120) at org.apache.tika.parser.RecursiveParserWrapper.parse(RecursiveParserWrapper.java:159) at org.apache.tika.server.resource.TikaResource.parse(TikaResource.java:244) at org.apache.tika.server.resource.RecursiveMetadataResource.parseMetadata(RecursiveMetadataResource.java:86) at org.apache.tika.server.resource.RecursiveMetadataResource.getMetadata(RecursiveMetadataResource.java:68) at sun.reflect.GeneratedMethodAccessor4.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181) at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200) at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:99) at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59) at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96) at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:251) at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:261) at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:70) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1088) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1024) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135) at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116) at org.eclipse.jetty.server.Server.handle(Server.java:370) at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:494) at org.eclipse.jetty.server.AbstractHttpConnection.content(AbstractHttpConnection.java:982) at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:1043) at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:865) at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:240) at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82) at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:696) at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608) at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java: ... (truncated) ...

Environment

  • Python: 2.7.9

Why It Broke

The issue arises from using text mode to open files, leading to incorrect content-length calculations

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install requests==2.27.0

When NOT to use: This fix is not applicable if files are intentionally opened in text mode for specific use cases.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Option D — Guard side-effects with OnceOnly Guardrail for side-effects

Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.

  • Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
  • Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
  • Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.
Show example snippet (optional)
onceonly.py
from onceonly import OnceOnly import os once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True) # Stable idempotency key per real side-effect. # Use a request id / job id / webhook delivery id / Stripe event id, etc. event_id = "evt_..." # replace key = f"stripe:webhook:{event_id}" res = once.check_lock(key=key, ttl=3600) if res.duplicate: return {"status": "already_processed"} # Safe to execute the side-effect exactly once. handle_event(event_id)

See OnceOnly SDK

When NOT to use: Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Fix reference: https://github.com/psf/requests/pull/2825

First fixed release: 2.27.0

Last verified: 2026-02-07. Validate in your environment.

Get updates

We publish verified fixes weekly. No spam.

Subscribe

When NOT to Use This Fix

  • This fix is not applicable if files are intentionally opened in text mode for specific use cases.
  • Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.

Verify Fix

verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

  • Add a stress test that runs high-concurrency workloads and fails on thread dumps / blocked locks.
  • Enable watchdog dumps in prod (faulthandler, thread dump endpoint) to capture deadlocks quickly.
  • Make timeouts explicit and test them (unit + integration) to avoid silent behavior changes.
  • Instrument retries (attempt count + reason) and alert on spikes to catch dependency slowdowns.

Version Compatibility Table

VersionStatus
2.27.0 Fixed

Related Issues

No related fixes found.

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.