Unexpected end of Stream, the content may have already been read by another component

Questions
,
1

Since the latest umbraco upgrade I see a lot of these errors:

Unexpected end of Stream, the content may have already been read by another component.

Source: Microsoft.AspNetCore.WebUtilities
Stack Trace: at Microsoft.AspNetCore.WebUtilities.MultipartReaderStream.ReadAsync(Memory1 buffer, CancellationToken cancellationToken) at Microsoft.AspNetCore.WebUtilities.StreamHelperExtensions.DrainAsync(Stream stream, ArrayPool1 bytePool, Nullable`1 limit, CancellationToken cancellationToken)
at Microsoft.AspNetCore.WebUtilities.MultipartReader.ReadNextSectionAsync(CancellationToken cancellationToken)
at Microsoft.AspNetCore.Http.Features.FormFeature.InnerReadFormAsync(CancellationToken cancellationToken)
at Microsoft.AspNetCore.Http.Features.FormFeature.ReadForm()
at Umbraco.Cms.Core.Routing.ContentFinderByPageIdQuery.TryFindContent(IPublishedRequestBuilder frequest)
at Umbraco.Cms.Core.Routing.PublishedRouter.FindPublishedContent(IPublishedRequestBuilder request)
at Umbraco.Cms.Core.Routing.PublishedRouter.RouteRequestInternalAsync(IPublishedRequestBuilder builder, Boolean skipContentFinders)
at Umbraco.Cms.Core.Routing.PublishedRouter.RouteRequestAsync(IPublishedRequestBuilder builder, RouteRequestOptions options)
at Umbraco.Cms.Web.Website.Routing.UmbracoRouteValueTransformer.RouteRequestAsync(IUmbracoContext umbracoContext)
at Umbraco.Cms.Web.Website.Routing.UmbracoRouteValueTransformer.TransformAsync(HttpContext httpContext, RouteValueDictionary values)
at Microsoft.AspNetCore.Mvc.Routing.DynamicControllerEndpointMatcherPolicy.ApplyAsync(HttpContext httpContext, CandidateSet candidates)
at Microsoft.AspNetCore.Routing.Matching.DfaMatcher.SelectEndpointWithPoliciesAsync(HttpContext httpContext, IEndpointSelectorPolicy policies, CandidateSet candidateSet)
at Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware.g__AwaitMatch|10_1(EndpointRoutingMiddleware middleware, HttpContext httpContext, Task matchTask)
at StackExchange.Profiling.MiniProfilerMiddleware.Invoke(HttpContext context) in C:\projects\dotnet\src\MiniProfiler.AspNetCore\MiniProfilerMiddleware.cs:line 112
at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
— End of stack trace from previous location —
at Umbraco.Cms.Web.Common.Middleware.PreviewAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
— End of stack trace from previous location —
at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestLoggingMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<b__0>d.MoveNext()
— End of stack trace from previous location —
at SixLabors.ImageSharp.Web.Middleware.ImageSharpMiddleware.Invoke(HttpContext httpContext, Boolean retry)
at VVDRotterdam._2024.Business.SecurityHeadersMiddleware.Invoke(HttpContext context) in D:\development\source\Projects\VVDRotterdam.2024\Business\SecurityHeadersMiddleware.cs:line 63
at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.g__Awaited|10_0(ExceptionHandlerMiddlewareImpl middleware, HttpContext context, Task task)

And I have discovered a pattern, all errors seems to have this content-type:
multipart/form-data; boundary=------------------------bissa_cve_boundary

And a user-agent like this: Python/3.14 aiohttp/3.13.2

3

Python/3.14 aiohttp/3.13.2 might be a giveaway that these are scripted requests, not real users. Aiohttp could be used in penetration testing or scraping.

It maybe worthwhile investigating logs (or adding more logs) further for any suspicious activity and maybe blocking them.

The upgrade could have changed middleware ordering or request handling, so these malformed requests now bubble up as visible exceptions instead of being silently dropped.

4

I also see them withe these variables:

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Host: www.vvdrotterdam.nl
Referer: https://rotterdam.vvd.nl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

And it looks like the redirect of https://rotterdam.vvd.nl to www.vvdrotterdam.nl is inlcuding a post?

Can you add some sample code logging that would be helpful for in the startup.cs?