Classic Load Balancer should be configured with defensive or strictest desync mitigation mode

How to fix it

Set the elb.http.desyncmitigationmode attribute to defensive or strictest on the Classic Load Balancer. Monitor mode forwards malformed requests and only counts them, which is why it fails. Defensive is AWS's documented default, so a load balancer whose attribute was never set passes. Strictest blocks everything that does not comply with RFC 7230 and can break a client that sends technically malformed requests.

In the console

EC2 -> Load balancers -> the load balancer -> Attributes -> Desync mitigation mode

With the AWS CLI

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes AdditionalAttributes=[{Key=elb.http.desyncmitigationmode,Value=defensive}] --region <region>

With Terraform

resource "aws_elb" "this" {
  desync_mitigation_mode = "defensive"

  listener {
    lb_port           = 80
    lb_protocol       = "http"
    instance_port     = 80
    instance_protocol = "http"
  }
}