Raw token length exceeds limit

Error message

Raw token length {raw_token_len} exceeds limit {MAX_PACKET_DATA_SIZE}

What it means

Thrown when the raw (identity) token length field in the Bedrock Login packet exceeds MAX_PACKET_DATA_SIZE. Like the other login guards, it validates the declared size before allocating, protecting the server from hostile oversized allocations. The packet fails with an InvalidData error.

Solutions

Check protocol version parity between client and server
Decode the packet offline to confirm the intended token size
Raise MAX_PACKET_DATA_SIZE only if legitimate tokens genuinely exceed it
Fix upstream length parsing (e.g. 496's JWT length) if the desync originates earlier

Defensive patterns

Strategy: validation

Validate before calling

fn raw_token_len_ok(len: usize) -> bool { len <= MAX_PACKET_DATA_SIZE }

Type guard

fn checked(len: u32) -> Option<usize> { usize::try_from(len).ok().filter(|&l| l <= MAX_PACKET_DATA_SIZE) }

Try / catch

match SLogin::read(reader) {
    Err(e) if e.to_string().contains("Raw token length") => { kick(peer, "oversized token"); Ok(()) }
    Err(e) => Err(e),
    Ok(l) => Ok(l),
}

Prevention

Validate all three login length fields (connection request, JWT, raw token) consistently
Confirm earlier fields parsed correctly — a bad JWT length desyncs this one
Rate-limit malformed login attempts per peer

When it happens

Trigger: A Login packet whose raw_token length field exceeds MAX_PACKET_DATA_SIZE; caused by crafted packets, fuzzing, or earlier field misalignment (e.g. wrong JWT length read) shifting the stream so a wrong value is interpreted as the token length.

Common situations: DoS probes on the login route, corrupted connections through proxies, or client/server protocol version mismatch.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/7db96cffc19ff87b. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-protocol/src/bedrock/server/login.rs:43

                format!(
                    "Connection request length {connection_request_len} exceeds limit {MAX_PACKET_DATA_SIZE}"
                ),
            ));
        }

        let jwt_len = u32::read(reader)? as usize;
        if jwt_len > MAX_PACKET_DATA_SIZE {
            return Err(Error::new(
                ErrorKind::InvalidData,
                format!("JWT length {jwt_len} exceeds limit {MAX_PACKET_DATA_SIZE}"),
            ));
        }
        let mut jwt = vec![0; jwt_len];
        reader.read_exact(&mut jwt)?;

        let raw_token_len = u32::read(reader)? as usize;
        if raw_token_len > MAX_PACKET_DATA_SIZE {
            return Err(Error::new(
                ErrorKind::InvalidData,
                format!("Raw token length {raw_token_len} exceeds limit {MAX_PACKET_DATA_SIZE}"),
            ));
        }
        let mut raw_token = vec![0; raw_token_len];
        reader.read_exact(&mut raw_token)?;

        Ok(Self {
            protocol_version,
            jwt,
            raw_token,
        })
    }
}

#[cfg(test)]
mod tests {
    use std::io::Cursor;

View on GitHub (pinned to 8d4639e25a)