diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index c014e4a..f884829 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -29,6 +29,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\TerminableInterface;
 use Composer\Autoload\ClassLoader;
 
@@ -314,7 +315,12 @@ public static function findSitePath(Request $request, $require_settings = TRUE)
     if (!$script_name) {
       $script_name = $request->server->get('SCRIPT_FILENAME');
     }
-    $http_host = $request->server->get('HTTP_HOST');
+    try {
+      $http_host = $request->getHost();
+    }
+    catch (\UnexpectedValueException $exception) {
+      throw new BadRequestHttpException(t('Bad request'));
+    }
 
     $sites = array();
     include DRUPAL_ROOT . '/sites/sites.php';
@@ -810,7 +816,16 @@ protected function initializeRequestGlobals(Request $request) {
     else {
       // Create base URL.
       $http_protocol = $request->isSecure() ? 'https' : 'http';
-      $base_root = $http_protocol . '://' . $request->server->get('HTTP_HOST');
+      try {
+        $base_root = $http_protocol . '://' . $request->getHost();
+        $port = $request->getPort();
+        if ($port != 80) {
+          $base_root .= ':' . $port;
+        }
+      }
+      catch (\UnexpectedValueException $exception) {
+        throw new BadRequestHttpException(t('Bad request'));
+      }
 
       $base_url = $base_root;
 
@@ -892,9 +907,7 @@ protected function initializeCookieGlobals(Request $request) {
       // Replace "core" out of session_name so core scripts redirect properly,
       // specifically install.php.
       $session_name = preg_replace('/\/core$/', '', $session_name);
-      // HTTP_HOST can be modified by a visitor, but has been sanitized already
-      // in DrupalKernel::bootEnvironment().
-      if ($cookie_domain = $request->server->get('HTTP_HOST')) {
+      if ($cookie_domain = $request->getHost()) {
         // Strip leading periods, www., and port numbers from cookie domain.
         $cookie_domain = ltrim($cookie_domain, '.');
         if (strpos($cookie_domain, 'www.') === 0) {