{"record":{"id":"016e3d944aff8b97","repo":"ipfs/kubo","slug":"download-exceeds-maximum-size-of-d-bytes","errorCode":null,"errorMessage":"download exceeds maximum size of %d bytes","messagePattern":"download exceeds maximum size of (.+?) bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/update_github.go","lineNumber":233,"sourceCode":"\t}\n\treq.Header.Set(\"User-Agent\", \"kubo/\"+version.CurrentVersionNumber)\n\n\tresp, err := http.DefaultClient.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"downloading asset: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"download returned HTTP %d\", resp.StatusCode)\n\t}\n\n\tdata, err := io.ReadAll(io.LimitReader(resp.Body, maxDownloadSize+1))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"reading download: %w\", err)\n\t}\n\tif int64(len(data)) > maxDownloadSize {\n\t\treturn nil, fmt.Errorf(\"download exceeds maximum size of %d bytes\", maxDownloadSize)\n\t}\n\treturn data, nil\n}\n\n// downloadAndVerifySHA512 downloads the .sha512 sidecar file for the given\n// archive URL and verifies the archive data against it.\nfunc downloadAndVerifySHA512(ctx context.Context, data []byte, archiveURL string) error {\n\tsha512URL := archiveURL + \".sha512\"\n\tchecksumData, err := downloadAsset(ctx, sha512URL)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"downloading checksum file: %w\", err)\n\t}\n\n\t// Parse \"<hex>  <filename>\\n\" format (standard sha512sum output).\n\tfields := strings.Fields(string(checksumData))\n\tif len(fields) < 1 {\n\t\treturn fmt.Errorf(\"empty or malformed .sha512 file\")\n\t}","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/update_github.go#L215-L251","documentation":"downloadAsset enforces a hard cap (maxDownloadSize) on every downloaded artifact to prevent unbounded memory use; it reads maxDownloadSize+1 bytes and fails if more than maxDownloadSize arrived, meaning the payload is implausibly large for a release asset.","triggerScenarios":"The download endpoint returns a body larger than maxDownloadSize: a captive portal or proxy serving a huge HTML error page with a 200 status, a misconfigured mirror, or an unexpectedly bloated/unexpected artifact at the URL.","commonSituations":"Corporate proxies or hotel/captive Wi-Fi that return 200 with an HTML interstitial instead of the binary; DNS hijacking by an ISP; pointing the updater at a non-GitHub mirror serving different content.","solutions":["Verify the network is not serving a captive portal or proxy interstitial page (open a browser and complete any login)","Check DNS resolution for github.com/objects.githubusercontent.com (ISP hijacking)","Inspect what the URL actually returns: `curl -sI <asset-url>` to see content type and length","Retry from a clean, unrestricted network connection"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// detect proxy/captive-portal interference before trusting 200 responses\nresp, err := http.Get(assetURL)\nif err == nil {\n\tct := resp.Header.Get(\"Content-Type\")\n\tif !strings.Contains(ct, \"application/\") && !strings.Contains(ct, \"gzip\") && ct != \"\" {\n\t\treturn fmt.Errorf(\"unexpected content type %q — proxy or captive portal interference\", ct)\n\t}\n\tresp.Body.Close()\n}","typeGuard":null,"tryCatchPattern":"if err := runUpdate(); err != nil {\n\tif strings.Contains(err.Error(), \"exceeds maximum size\") {\n\t\t// almost certainly a proxy/portal returning non-asset content; check network\n\t\tlog.Print(\"download is implausibly large: check for captive portal or proxy\")\n\t}\n\treturn err\n}","preventionTips":["Complete captive-portal login before running the updater on public/hotel Wi-Fi","Exclude github.com and objects.githubusercontent.com from TLS-intercepting proxies","Validate DNS responses for github.com if your ISP is known to hijack","Never point the updater at unofficial mirrors serving different content"],"tags":["network","download","size-limit","proxy"],"backgroundTag":"response-size-limit-exceeded","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}