{"record":{"id":"21fbacab91840ee0","repo":"Pumpkin-MC/Pumpkin","slug":"connection-request-length-connection-request-len","errorCode":null,"errorMessage":"Connection request length {connection_request_len} exceeds limit {MAX_PACKET_DATA_SIZE}","messagePattern":"Connection request length (.+?) exceeds limit (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/pumpkin-protocol/src/bedrock/server/login.rs","lineNumber":23,"sourceCode":"use crate::{MAX_PACKET_DATA_SIZE, codec::var_uint::VarUInt, serial::PacketRead};\n\n#[packet(1)]\npub struct SLogin {\n    // https://mojang.github.io/bedrock-protocol-docs/html/LoginPacket.html\n    //#[serial(big_endian)]\n    pub protocol_version: i32,\n\n    // https://mojang.github.io/bedrock-protocol-docs/html/connectionRequest.html\n    pub jwt: Vec<u8>,\n    pub raw_token: Vec<u8>,\n}\n\nimpl PacketRead for SLogin {\n    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {\n        let protocol_version = i32::read_be(reader)?;\n        let connection_request_len = VarUInt::read(reader)?.0 as usize;\n        if connection_request_len > MAX_PACKET_DATA_SIZE {\n            return Err(Error::new(\n                ErrorKind::InvalidData,\n                format!(\n                    \"Connection request length {connection_request_len} exceeds limit {MAX_PACKET_DATA_SIZE}\"\n                ),\n            ));\n        }\n\n        let jwt_len = u32::read(reader)? as usize;\n        if jwt_len > MAX_PACKET_DATA_SIZE {\n            return Err(Error::new(\n                ErrorKind::InvalidData,\n                format!(\"JWT length {jwt_len} exceeds limit {MAX_PACKET_DATA_SIZE}\"),\n            ));\n        }\n        let mut jwt = vec![0; jwt_len];\n        reader.read_exact(&mut jwt)?;\n\n        let raw_token_len = u32::read(reader)? as usize;","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/bedrock/server/login.rs#L5-L41","documentation":"Thrown by SLogin::read when the VarUInt-prefixed connection request blob in a Bedrock login packet exceeds MAX_PACKET_DATA_SIZE. The check runs before allocation to prevent memory-exhaustion from hostile or malformed login packets. The packet is rejected with an InvalidData error.","triggerScenarios":"A client sends a Login packet whose connection_request length field exceeds MAX_PACKET_DATA_SIZE; typically crafted packets, fuzzing, or a stream desync where a later field is misread as the length prefix.","commonSituations":"Modified Bedrock clients, DoS probes against the login handler, or version mismatch causing field-boundary misalignment.","solutions":["Verify the client's protocol version matches the server","Capture and decode the login packet to check the real connection_request size","For a legitimate oversized login (rare), raise MAX_PACKET_DATA_SIZE in crates/pumpkin-protocol/src/bedrock/server/login.rs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fn connection_request_len_ok(len: usize) -> bool { len <= MAX_PACKET_DATA_SIZE }","typeGuard":"fn checked_len(len: u32) -> Option<usize> { usize::try_from(len).ok().filter(|&l| l <= MAX_PACKET_DATA_SIZE) }","tryCatchPattern":"match SLogin::read(reader) {\n    Err(e) if e.kind() == ErrorKind::InvalidData => { disconnect(peer, \"malformed login\"); Ok(()) }\n    Err(e) => Err(e),\n    Ok(login) => authenticate(login),\n}","preventionTips":["Rate-limit and size-check login packets at the raknet layer before decoding","Keep client/server protocol versions aligned","Treat repeated oversized login packets as an attack signal and ban the peer"],"tags":["protocol","bedrock","login","size-limit","security"],"backgroundTag":"payload-too-large","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}