{"record":{"id":"18542c9c97ec537c","repo":"valyala/fasthttp","slug":"too-large-hex-number","errorCode":null,"errorMessage":"too large hex number","messagePattern":"too large hex number","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"bytesconv.go","lineNumber":369,"sourceCode":"\n// ParseUfloat parses unsigned float from buf.\nfunc ParseUfloat(buf []byte) (float64, error) {\n\t// The implementation of parsing a float string is not easy.\n\t// We believe that the conservative approach is to call strconv.ParseFloat.\n\t// https://github.com/valyala/fasthttp/pull/1865\n\tres, err := strconv.ParseFloat(b2s(buf), 64)\n\tif res < 0 {\n\t\treturn -1, errors.New(\"negative input is invalid\")\n\t}\n\tif err != nil {\n\t\treturn -1, err\n\t}\n\treturn res, err\n}\n\nvar (\n\terrEmptyHexNum    = errors.New(\"empty hex number\")\n\terrTooLargeHexNum = errors.New(\"too large hex number\")\n)\n\nfunc readHexInt(r *bufio.Reader) (int, error) {\n\tvar k, i, n int\n\tfor {\n\t\tc, err := r.ReadByte()\n\t\tif err != nil {\n\t\t\tif err == io.EOF && i > 0 {\n\t\t\t\treturn n, nil\n\t\t\t}\n\t\t\treturn -1, err\n\t\t}\n\t\tk = int(hex2intTable[c])\n\t\tif k == 16 {\n\t\t\tif i == 0 {\n\t\t\t\treturn -1, errEmptyHexNum\n\t\t\t}\n\t\t\tif err := r.UnreadByte(); err != nil {","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/bytesconv.go#L351-L387","documentation":"errTooLargeHexNum is returned by readHexInt in bytesconv.go when parsing a hexadecimal integer (typically a chunked-transfer chunk size) whose value overflows an int. fasthttp aborts parsing because the wire data does not fit a valid integer, so the response/request is treated as malformed.","triggerScenarios":"A peer sends a chunked HTTP body whose chunk-size hex line is enormous (e.g. leading digits that exceed math.MaxInt) so readHexInt's accumulation overflows; also hit when decoding Content-Length-style hex fields via internal helpers.","commonSituations":"Talking to a buggy or malicious server/proxy that emits invalid chunked encoding; fuzzed or corrupted responses; hand-crafted raw HTTP over a custom connection.","solutions":["Fix or stop using the peer that emits the oversized hex value — the sender's chunked encoding is malformed","Verify proxies/load balancers in front are not corrupting chunked bodies","Update fasthttp; parsing paths get hardening over time","If you call readHexInt-like parsing yourself, pre-check the digit count/value before accumulating"],"exampleFix":"// before: trusting an untrusted peer's chunked response\nresp, err := client.Get(nil, \"http://untrusted-peer/bin\")\n// after: bound and validate the peer response, or use a checked proxy\nclient.ReadTimeout = time.Second * 10\nresp, err := client.Get(nil, \"http://validated-peer/bin\")\nif err != nil { /* check for malformed chunked peer */ }","handlingStrategy":"validation","validationCode":"// Bound response parsing before trusting a peer\nclient.ReadTimeout = 10 * time.Second\nif resp.Header.Peek(fasthttp.HeaderTransferEncoding) != nil {\n    // treat oversized/malformed chunked peers as untrusted\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    // errTooLargeHexNum is unexported: match on message\n    if strings.Contains(err.Error(), \"too large hex number\") {\n        // mark peer as broken; do not retry the same payload\n    }\n}","preventionTips":["Only parse chunked responses from peers known to emit valid HTTP","Set read timeouts so malformed peers fail fast","Keep fasthttp updated for parsing hardening","Validate proxies/LBs are not rewriting chunked bodies"],"tags":["http","parsing","chunked-encoding","protocol-violation"],"backgroundTag":"http-protocol-violation","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}