diff -u b/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
--- b/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -29,6 +29,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\TerminableInterface;
 use Composer\Autoload\ClassLoader;
 
@@ -314,7 +315,12 @@
     if (!$script_name) {
       $script_name = $request->server->get('SCRIPT_FILENAME');
     }
-    $http_host = $request->getHost();
+    try {
+      $http_host = $request->getHost();
+    }
+    catch (\UnexpectedValueException $exception) {
+      throw new BadRequestHttpException(t('Bad request'));
+    }
 
     $sites = array();
     include DRUPAL_ROOT . '/sites/sites.php';
@@ -810,7 +816,12 @@
     else {
       // Create base URL.
       $http_protocol = $request->isSecure() ? 'https' : 'http';
-      $base_root = $http_protocol . '://' . $request->getHost();
+      try {
+        $base_root = $http_protocol . '://' . $request->getHost();
+      }
+      catch (\UnexpectedValueException $exception) {
+        throw new BadRequestHttpException(t('Bad request'));
+      }
 
       $base_url = $base_root;