Index: src/OFHTTPServer.h
==================================================================
--- src/OFHTTPServer.h
+++ src/OFHTTPServer.h
@@ -62,11 +62,12 @@
  */
 -			  (bool)server: (OFHTTPServer *)server
   didReceiveExceptionOnListeningSocket: (id)exception;
 
 /**
- * @brief This method is called when a client socket encountered an exception.
+ * @brief This method is called when a socket for a client encountered an
+ * exception.
  *
  * This can happen when the OFHTTPServer tries to properly close the
  * connection. If no headers have been sent yet, it will send headers, and if
  * chunked transfer encoding was used, it will send a chunk of size 0. However,
  * if the other end already closed the connection before that, this will raise

Index: src/OFHTTPServer.m
==================================================================
--- src/OFHTTPServer.m
+++ src/OFHTTPServer.m
@@ -536,20 +536,27 @@
 	URL.scheme = @"http";
 	URL.host = _host;
 	if (_port != 80)
 		URL.port = [OFNumber numberWithUnsignedShort: _port];
 
-	if ((pos = [_path rangeOfString: @"?"].location) != OFNotFound) {
-		OFString *path, *query;
-
-		path = [_path substringToIndex: pos];
-		query = [_path substringFromIndex: pos + 1];
-
-		URL.URLEncodedPath = path;
-		URL.URLEncodedQuery = query;
-	} else
-		URL.URLEncodedPath = _path;
+	@try {
+		if ((pos = [_path rangeOfString: @"?"].location) !=
+		    OFNotFound) {
+			OFString *path, *query;
+
+			path = [_path substringToIndex: pos];
+			query = [_path substringFromIndex: pos + 1];
+
+			URL.URLEncodedPath = path;
+			URL.URLEncodedQuery = query;
+		} else
+			URL.URLEncodedPath = _path;
+	} @catch (OFInvalidFormatException *e) {
+		objc_autoreleasePoolPop(pool);
+		[self sendErrorAndClose: 400];
+		return;
+	}
 
 	[URL makeImmutable];
 
 	request = [OFHTTPRequest requestWithURL: URL];
 	request.method = _method;