diff --git a/scripts/base/protocols/http/entities.zeek b/scripts/base/protocols/http/entities.zeek
index 4b4c8a8c67..2f21ea54e4 100644
--- a/scripts/base/protocols/http/entities.zeek
+++ b/scripts/base/protocols/http/entities.zeek
@@ -103,7 +103,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 		c$http$current_entity$filename = extract_filename_from_content_disposition(value);
 		}
 	else if ( name == "CONTENT-TYPE" &&
-	          /[nN][aA][mM][eE][:blank:]*=/ in value )
+	          /[nN][aA][mM][eE][[:blank:]]*=/ in value )
 		{
 		c$http$current_entity$filename = extract_filename_from_content_disposition(value);
 		}
diff --git a/scripts/base/protocols/smtp/entities.zeek b/scripts/base/protocols/smtp/entities.zeek
index 20fdfd816b..2dc4e6eac3 100644
--- a/scripts/base/protocols/smtp/entities.zeek
+++ b/scripts/base/protocols/smtp/entities.zeek
@@ -67,7 +67,7 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
 		c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
 
 	if ( h$name == "CONTENT-TYPE" &&
-	     /[nN][aA][mM][eE][:blank:]*=/ in h$value )
+	     /[nN][aA][mM][eE][[:blank:]]*=/ in h$value )
 		c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
 	}