diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 080ef3a784..6bd661da98 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1783,7 +1783,11 @@ static int HtpResponseBodyHandle(HtpState *hstate, HtpTxUserData *htud,
      * we check for tx->response_line in case of junk
      * interpreted as body before response line
      */
-    if (!(htud->tcflags & HTP_FILENAME_SET)) {
+    if (!(htud->tcflags & HTP_RESP_BODY_SEEN)) {
+        // make sure we run this only once per tx
+        // so that we do not retry/refail to parse Content-Disposition header
+        // which may be expensive if we do it for every packet...
+        htud->tcflags |= HTP_RESP_BODY_SEEN;
         SCLogDebug("setting up file name");
 
         uint8_t *filename = NULL;
diff --git a/src/app-layer-htp.h b/src/app-layer-htp.h
index 7a87d49c35..18a66a65c6 100644
--- a/src/app-layer-htp.h
+++ b/src/app-layer-htp.h
@@ -203,6 +203,7 @@ typedef struct HtpBody_ {
 #define HTP_FILENAME_SET        BIT_U8(3)    /**< filename is registered in the flow */
 #define HTP_DONTSTORE           BIT_U8(4)    /**< not storing this file */
 #define HTP_STREAM_DEPTH_SET    BIT_U8(5)    /**< stream-depth is set */
+#define HTP_RESP_BODY_SEEN      BIT_U8(6)    /**< response body was seen at least once */
 
 /** Now the Body Chunks will be stored per transaction, at
   * the tx user data */