diff --git a/router/src/main/kotlin/io/moia/router/APIGatewayProxyEventExtensions.kt b/router/src/main/kotlin/io/moia/router/APIGatewayProxyEventExtensions.kt
index ed3da188..3b907c3b 100644
--- a/router/src/main/kotlin/io/moia/router/APIGatewayProxyEventExtensions.kt
+++ b/router/src/main/kotlin/io/moia/router/APIGatewayProxyEventExtensions.kt
@@ -10,7 +10,7 @@ fun APIGatewayProxyRequestEvent.acceptHeader() = getHeaderCaseInsensitive("accep
 fun APIGatewayProxyRequestEvent.acceptedMediaTypes() = acceptHeader()
     ?.split(",")
     ?.map { it.trim() }
-    ?.map { MediaType.parse(it) }
+    ?.mapNotNull { parseMediaTypeSafe(it) }
     .orEmpty()
 fun APIGatewayProxyRequestEvent.contentType() = getHeaderCaseInsensitive("content-type")
 
@@ -68,3 +68,10 @@ private fun getCaseInsensitive(key: String, map: Map<String, String>?): String?
         ?.value
 
 fun APIGatewayProxyResponseEvent.bodyAsBytes() = Base64.getDecoder().decode(body)
+
+private fun parseMediaTypeSafe(input: String): MediaType? =
+    try {
+        MediaType.parse(input)
+    } catch (e: IllegalArgumentException) {
+        null
+    }
diff --git a/router/src/test/kotlin/io/moia/router/RequestHandlerTest.kt b/router/src/test/kotlin/io/moia/router/RequestHandlerTest.kt
index 9a8a39c0..694100e3 100644
--- a/router/src/test/kotlin/io/moia/router/RequestHandlerTest.kt
+++ b/router/src/test/kotlin/io/moia/router/RequestHandlerTest.kt
@@ -336,6 +336,21 @@ class RequestHandlerTest {
         assert(response.body).isEqualTo("""{"greeting":"some"}""")
     }
 
+    @Test
+    fun `should fail with 406 Not Acceptable on an unparsable media type`() {
+
+        val response = testRequestHandler.handleRequest(
+            POST("/some")
+                .withHeaders(mapOf(
+                    "Accept" to "*",
+                    "Content-Type" to "application/json"
+                ))
+                .withBody("""{ "greeting": "some" }"""), mockk()
+        )
+
+        assert(response.statusCode).isEqualTo(406)
+    }
+
     @Test
     fun `should match request requiring permission`() {