From 5ec9d0522aeb01fbda0e7974235004e08cc653ac Mon Sep 17 00:00:00 2001
From: Bogdan <matolq@gmail.com>
Date: Sun, 1 Nov 2026 00:03:37 +0100
Subject: [PATCH] fix(HTTP): remove invalid CURLOPT_HTTPHEADER string
 assignment in CURLRequest

---
 system/HTTP/CURLRequest.php                 |  3 +--
 tests/system/HTTP/CURLRequestTest.php       | 10 ++++++----
 user_guide_src/source/changelogs/v4.7.6.rst |  1 +
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php
index 5ef3352f3da6..7b07c10bec71 100644
--- a/system/HTTP/CURLRequest.php
+++ b/system/HTTP/CURLRequest.php
@@ -813,8 +813,7 @@ private function applyResponseOptions(array $curlOptions, array $config): array
             if ($accept !== '') {
                 $curlOptions[CURLOPT_ENCODING] = $accept;
             } else {
-                $curlOptions[CURLOPT_ENCODING]   = '';
-                $curlOptions[CURLOPT_HTTPHEADER] = 'Accept-Encoding';
+                $curlOptions[CURLOPT_ENCODING] = '';
             }
         }
 
diff --git a/tests/system/HTTP/CURLRequestTest.php b/tests/system/HTTP/CURLRequestTest.php
index f0260ff839c9..e903593bf6fc 100644
--- a/tests/system/HTTP/CURLRequestTest.php
+++ b/tests/system/HTTP/CURLRequestTest.php
@@ -673,7 +673,6 @@ public function testDecodeContent(): void
 
     public function testDecodeContentWithoutAccept(): void
     {
-        //      $this->request->setHeader('Accept-Encoding', 'cobol');
         $this->request->request('get', 'http://example.com', [
             'decode_content' => true,
         ]);
@@ -682,8 +681,11 @@ public function testDecodeContentWithoutAccept(): void
 
         $this->assertArrayHasKey(CURLOPT_ENCODING, $options);
         $this->assertSame('', $options[CURLOPT_ENCODING]);
-        $this->assertArrayHasKey(CURLOPT_HTTPHEADER, $options);
-        $this->assertSame('Accept-Encoding', $options[CURLOPT_HTTPHEADER]);
+        $this->assertArrayNotHasKey(CURLOPT_HTTPHEADER, $options);
+
+        // Verify that curl_setopt_array accepts the options without TypeError
+        $handle = curl_init();
+        $this->assertTrue(curl_setopt_array($handle, $options));
     }
 
     public function testAllowRedirectsOptionFalse(): void
@@ -1629,7 +1631,7 @@ public function testSetCURLOptions(): void
         // Test Response Options (decode_content / http_errors)
         $options12 = $invoker([], ['decode_content' => true]);
         $this->assertSame('', $options12[CURLOPT_ENCODING]);
-        $this->assertSame('Accept-Encoding', $options12[CURLOPT_HTTPHEADER]);
+        $this->assertArrayNotHasKey(CURLOPT_HTTPHEADER, $options12);
 
         // Test Protocol/Misc/Client Options
         $options13 = $invoker([], [
diff --git a/user_guide_src/source/changelogs/v4.7.6.rst b/user_guide_src/source/changelogs/v4.7.6.rst
index a609e8cbd9f3..c5ebe64e6cad 100644
--- a/user_guide_src/source/changelogs/v4.7.6.rst
+++ b/user_guide_src/source/changelogs/v4.7.6.rst
@@ -46,6 +46,7 @@ Bugs Fixed
 - **HTTP:** Fixed a bug in ``ContentSecurityPolicy`` where a numeric source such as ``'0'`` threw a ``TypeError``, and a space-separated directive string in ``Config\\ContentSecurityPolicy`` was emitted as one unquoted source.
 - **HTTP:** Fixed a regression in v4.7.0 where calling ``ContentSecurityPolicy::reportOnly()`` after the policy was created did not apply to array sources from ``Config\\ContentSecurityPolicy``, so they stayed in the enforced ``Content-Security-Policy`` header alongside the ``Content-Security-Policy-Report-Only`` header.
 - **HTTP:** Fixed a bug in ``ContentSecurityPolicy::setDefaultSrc()`` where passing an array of URIs resulted in an invalid ``'Array'`` directive.
+- **HTTP:** Fixed a bug where ``CURLRequest`` threw a ``TypeError`` when ``decode_content`` was enabled without custom request headers because ``CURLOPT_HTTPHEADER`` was set to a string instead of an array.
 - **HTTP:** Fixed a bug where ``IncomingRequest`` did not read the request body when PHP's ``post_max_size`` was set to ``0`` or ``-1`` (unlimited).
 - **HTTP:** Fixed a bug where ``IncomingRequest::isSecure()`` did not recognize ``https`` in the ``X-Forwarded-Proto`` header from a trusted proxy when the value contained uppercase letters or surrounding whitespace, or was represented as a single-element array.
 - **HTTP:** Fixed a bug where ``Negotiate::media()`` threw an ``ErrorException`` when the ``Accept`` header contained a value without a subtype, such as ``json`` or an empty list element. Such values are now ignored.