{"record":{"id":"0fd14e916d2ed0bc","repo":"vectordotdev/vector","slug":"invalid-chunk-header-with-less-than-10-bytes-0x-h","errorCode":null,"errorMessage":"Invalid chunk header with less than 10 bytes: 0x{header:0x}","messagePattern":"Invalid chunk header with less than 10 bytes: 0x(.+?)","errorType":"validation","errorClass":"ChunkedGelfDecoderError","httpStatus":null,"severity":"error","filePath":"lib/codecs/src/decoding/framing/chunked_gelf.rs","lineNumber":343,"sourceCode":"    pub fn decode_chunk(\n        &mut self,\n        mut chunk: Bytes,\n    ) -> Result<Option<Bytes>, ChunkedGelfDecoderError> {\n        // Encoding scheme:\n        //\n        // +------------+-----------------+--------------+----------------------+\n        // | Message id | Sequence number | Total chunks |    Chunk payload     |\n        // +------------+-----------------+--------------+----------------------+\n        // | 64 bits    | 8 bits          | 8 bits       | remaining bits       |\n        // +------------+-----------------+--------------+----------------------+\n        //\n        // As this codec is oriented for UDP, the chunks (datagrams) are not guaranteed to be received in order,\n        // nor to be received at all. So, we have to store the chunks in a buffer (state field) until we receive\n        // all the chunks of a message. When we receive all the chunks of a message, we can concatenate them\n        // and return the complete payload.\n\n        // We need 10 bytes to read the message id, sequence number and total chunks\n        ensure!(\n            chunk.remaining() >= 10,\n            InvalidChunkHeaderSnafu { header: chunk }\n        );\n\n        let message_id = chunk.get_u64();\n        let sequence_number = chunk.get_u8();\n        let total_chunks = chunk.get_u8();\n\n        ensure!(\n            total_chunks > 0 && total_chunks <= GELF_MAX_TOTAL_CHUNKS,\n            InvalidTotalChunksSnafu {\n                message_id,\n                sequence_number,\n                total_chunks\n            }\n        );\n\n        ensure!(","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/vectordotdev/vector/blob/99894c8d8885659cc16efc39bd71f9fb3b59e296/lib/codecs/src/decoding/framing/chunked_gelf.rs#L325-L361","documentation":"The chunked GELF decoder requires at least 10 bytes after the 2-byte magic (`0x1e 0x0f`): an 8-byte message id, 1-byte sequence number, and 1-byte total chunks. If a datagram reaches `get_pending_chunk`'s header parse with fewer than 10 bytes remaining, the `ensure!` fires `InvalidChunkHeaderSnafu` and the decoded datagram is rejected with `Invalid chunk header with less than 10 bytes: 0x{header}`. It is a per-datagram decode error, not a crash.","triggerScenarios":"A UDP datagram whose payload matches the chunked-GELF magic but is truncated (2–11 bytes total), or random binary/non-GELF traffic on the same port that happens to begin with `0x1e 0x0f`; also MTU-sized re-sends that get cut off mid-header.","commonSituations":"Port reuse where another protocol's binary traffic lands on the GELF input; buggy GELF senders (custom libraries) that emit the magic then an undersized header; network equipment truncating tiny datagrams.","solutions":["Verify the sender actually emits the GELF chunked format (`0x1e 0x0f` + 8-byte id + seq + total + payload) with a capture (tcpdump) before the change.","Point non-GELF traffic at a different port/source so it cannot be mistaken for chunked GELF.","Fix or upgrade the producing library that emits malformed chunk headers."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match decoder.decode(&mut buf).await {\n    Ok(Some(bytes)) => { /* forward */ }\n    Ok(None) => {}\n    Err(e) if e.to_string().contains(\"Invalid chunk header\") => {\n        // malformed datagram: log and drop, keep the source alive\n        warn!(error = %e, \"dropping malformed GELF chunk\");\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Dedicate one UDP port per protocol; never share it between GELF and other binary traffic.","tcpdump the input when first enabling chunked GELF to confirm header layout.","Treat per-chunk framing errors as drop-and-continue, not fatal."],"tags":["gelf","udp","framing","decode","vector"],"backgroundTag":"gelf-chunk-header-invalid","analyzedSha":"99894c8d8885659cc16efc39bd71f9fb3b59e296","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}