diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek
index f54216b0dd..e0f0cdc0a0 100644
--- a/scripts/base/protocols/http/main.zeek
+++ b/scripts/base/protocols/http/main.zeek
@@ -290,7 +290,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 			{
 			if ( /^[bB][aA][sS][iI][cC] / in value )
 				{
-				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
+				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]+/, ""));
 				local up = split_string(userpass, /:/);
 				if ( |up| >= 2 )
 					{