{"record":{"id":"1939944b34c04cbe","repo":"apple/pkl","slug":"unable-to-decode-s-of-length-d-exceeded-maximum","errorCode":null,"errorMessage":"Unable to decode %s of length %d, exceeded maximum collection size of %d","messagePattern":"Unable to decode (.+?) of length (.+?), exceeded maximum collection size of (.+?)","errorType":"validation","errorClass":"DecodeException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/util/pklbinary/AbstractPklBinaryDecoder.java","lineNumber":190,"sourceCode":"      case LIST -> decodeList(len);\n      case LISTING -> decodeListing(len);\n      case SET -> decodeSet(len);\n      case DURATION -> decodeDuration(len);\n      case DATASIZE -> decodeDataSize(len);\n      case PAIR -> decodePair(len);\n      case INTSEQ -> decodeIntSeq(len);\n      case REGEX -> decodeRegex(len);\n      case CLASS -> decodeClass(len);\n      case TYPEALIAS -> decodeTypeAlias(len);\n      case FUNCTION -> decodeFunction(len);\n      case BYTES -> decodeBytes(len);\n      default -> throw new DecodeException(\"Unrecognized object code %s\", code);\n    };\n  }\n\n  private void checkCollectionLength(int length, String collectionType) {\n    if (length <= collectionSizeLimit) return;\n    throw new DecodeException(\n        \"Unable to decode %s of length %d, exceeded maximum collection size of %d\",\n        collectionType, length, collectionSizeLimit);\n  }\n\n  private Object decodeObject(int len) throws IOException {\n    assertLength(PklBinaryCode.OBJECT, len, 3);\n    currPath.push(\"'object\");\n\n    var className = unpacker.unpackString();\n    if (className.isBlank()) {\n      throw new DecodeException(\"Unexpected blank object class name\");\n    }\n    var classModuleUriString = unpacker.unpackString();\n    if (classModuleUriString.isBlank()) {\n      throw new DecodeException(\"Unexpected blank object module URI\");\n    }\n    var classModuleUri = URI.create(classModuleUriString);\n","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/util/pklbinary/AbstractPklBinaryDecoder.java#L172-L208","documentation":"This DecodeException is thrown when a Pkl binary payload declares a collection (list, set, or map) whose declared length exceeds the decoder's configured collectionSizeLimit. The Pkl binary decoder refuses to allocate/iterate collections beyond this safety cap to prevent memory exhaustion from malformed or hostile input.","triggerScenarios":"Calling a Pkl binary decoder (AbstractPklBinaryDecoder, e.g. via PklObjectDecoder/Evaluator decoding pkl-binary input) on bytes where an array/map header declares a length larger than the decoder's collectionSizeLimit; decoding a payload produced by an encoder with a much larger limit or crafted by hand.","commonSituations":"Decoding a truncated or hand-edited .pkl binary file where the header length is garbage; decoding an untrusted binary payload; mixing decoder configurations where the producing side allows larger collections than the consuming side.","solutions":["Increase the decoder's collectionSizeLimit to cover the largest collection you legitimately decode","Re-encode the payload with a correct/non-corrupted header (verify the encoder version matches the decoder)","Validate collection sizes in the payload before decoding untrusted input","If the payload is genuinely malformed, regenerate it from the source Pkl module"],"exampleFix":"// before\nvar decoder = new PklBinaryDecoder(bytes); // default collectionSizeLimit\n// after\nvar decoder = new PklBinaryDecoder(bytes, /* collectionSizeLimit */ 1_000_000);","handlingStrategy":"validation","validationCode":"long declaredLen = peekCollectionLength(payload); // inspect array/map header\nif (declaredLen > MAX_ALLOWED_COLLECTION) {\n  throw new IllegalArgumentException(\"Payload declares collection of \" + declaredLen);\n}\nvar value = decoder.decode(payload);","typeGuard":null,"tryCatchPattern":"try {\n  return decoder.decode(bytes);\n} catch (DecodeException e) {\n  if (e.getMessage().contains(\"exceeded maximum collection size\")) {\n    throw new PayloadLimitException(e);\n  }\n  throw e;\n}","preventionTips":["Know your decoder's collectionSizeLimit and the max collection your producers emit","Never decode untrusted payloads without a limit check first","Keep encoder and decoder configurations symmetric","Log the collection type/length from the message to size limits appropriately"],"tags":["pkl","binary-decoder","limits","collections"],"backgroundTag":"payload-too-large","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}