{"record":{"id":"0fd14e916d2ed0bc","repo":"vectordotdev/vector","slug":"invalid-chunk-header-with-less-than-10-bytes-0x-h","errorCode":null,"errorMessage":"Invalid chunk header with less than 10 bytes: 0x{header:0x}","messagePattern":"Invalid chunk header with less than 10 bytes: 0x(.+?)","errorType":"error_code","errorClass":"ChunkedGelfDecoderError::InvalidChunkHeader","httpStatus":null,"severity":"error","filePath":"lib/codecs/src/decoding/framing/chunked_gelf.rs","lineNumber":409,"sourceCode":"    pub fn decode_chunk(\n        &mut self,\n        mut chunk: Bytes,\n    ) -> Result<Option<Bytes>, ChunkedGelfDecoderError> {\n        // Encoding scheme:\n        //\n        // +------------+-----------------+--------------+----------------------+\n        // | Message id | Sequence number | Total chunks |    Chunk payload     |\n        // +------------+-----------------+--------------+----------------------+\n        // | 64 bits    | 8 bits          | 8 bits       | remaining bits       |\n        // +------------+-----------------+--------------+----------------------+\n        //\n        // As this codec is oriented for UDP, the chunks (datagrams) are not guaranteed to be received in order,\n        // nor to be received at all. So, we have to store the chunks in a buffer (state field) until we receive\n        // all the chunks of a message. When we receive all the chunks of a message, we can concatenate them\n        // and return the complete payload.\n\n        // We need 10 bytes to read the message id, sequence number and total chunks\n        ensure!(\n            chunk.remaining() >= 10,\n            InvalidChunkHeaderSnafu { header: chunk }\n        );\n\n        let message_id = chunk.get_u64();\n        let sequence_number = chunk.get_u8();\n        let total_chunks = chunk.get_u8();\n\n        ensure!(\n            total_chunks > 0 && total_chunks <= GELF_MAX_TOTAL_CHUNKS,\n            InvalidTotalChunksSnafu {\n                message_id,\n                sequence_number,\n                total_chunks\n            }\n        );\n\n        ensure!(","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/vectordotdev/vector/blob/bdb87aeaa4c4ff27c0ba643c1c77b21bf2ef4013/lib/codecs/src/decoding/framing/chunked_gelf.rs#L391-L427","documentation":"The GELF chunked framing decoder needs at least 10 bytes per chunk: an 8-byte message id, a 1-byte sequence number, and a 1-byte total-chunks count. If a received datagram has fewer than 10 remaining bytes, `decode_chunk` rejects it via `InvalidChunkHeaderSnafu` including the chunk contents in hex. This guards the subsequent `get_u64`/`get_u8` reads from underflowing the buffer.","triggerScenarios":"A UDP datagram passed to decode_message/decode_chunk contains fewer than 10 bytes — e.g. a truncated packet, a GELF message sent unchunked but routed to the chunked decoder, or a corrupted/empty datagram.","commonSituations":"A sender emitting small GELF payloads without chunking them (GELF spec says messages under ~8KB should not be chunked) while the source is configured with chunked GELF framing; MTU truncation or packet corruption on the network; a non-GELF sender hitting the GELF UDP port.","solutions":["Verify the sender chunks messages per the GELF spec (chunk only when payload exceeds the chunk size) — a sub-10-byte datagram is not a valid chunk header.","If messages are meant to be unchunked, reconfigure the source to use plain GELF framing instead of chunked GELF.","Capture packets (tcpdump/Wireshark) to identify the source of truncated or non-GELF datagrams and fix the upstream client.","Check network path for MTU/fragmentation issues that could truncate UDP payloads."],"exampleFix":"# before: sender always chunks even tiny messages\nsend_udp(gelf_bytes)  # 8 bytes -> error\n\n# after: only chunk large messages\nif gelf_bytes.len() > CHUNK_SIZE { send_chunked(gelf_bytes) } else { send_udp(gelf_bytes) }","handlingStrategy":"validation","validationCode":"// sender-side guard: only chunk messages that exceed the chunk size\nif payload.len() < 10 || payload.len() <= CHUNK_SIZE {\n    // do not use chunked framing for tiny/unchunked messages\n    send_unchunked(payload);\n}","typeGuard":null,"tryCatchPattern":"match framing.decode(&datagram) {\n    Err(e) if e.to_string().contains(\"Invalid chunk header\") => {\n        warn!(\"dropping non-chunked/truncated GELF datagram ({} bytes)\", datagram.len());\n    }\n    other => { /* handle normally */ }\n}","preventionTips":["Verify senders follow the GELF chunking spec: never emit chunks smaller than the 10-byte header.","Only enable chunked GELF framing for senders that actually chunk their messages.","Monitor for UDP truncation/corruption with packet captures when this error appears in production."],"tags":["gelf","udp","codecs","framing","rust"],"backgroundTag":"invalid-argument-value","analyzedSha":"bdb87aeaa4c4ff27c0ba643c1c77b21bf2ef4013","analyzedAt":"2026-09-16T02:53:35.741Z","contentChangedAt":"2026-09-16T02:53:35.741Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}