{"record":{"id":"23edf31a4e8d4bcb","repo":"cloudflare/cloudflared","slug":"unsupported-command-version-v","errorCode":null,"errorMessage":"Unsupported command version: %v","messagePattern":"Unsupported command version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/request.go","lineNumber":84,"sourceCode":"\t// Requested command\n\tCommand uint8\n\t// AddrSpec of the destination\n\tDestAddr *AddrSpec\n\t// reading from the connection\n\tbufConn io.Reader\n}\n\n// NewRequest creates a new request from the connection data stream\nfunc NewRequest(bufConn io.Reader) (*Request, error) {\n\t// Read the version byte\n\theader := []byte{0, 0, 0}\n\tif _, err := io.ReadAtLeast(bufConn, header, 3); err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to get command version: %v\", err)\n\t}\n\n\t// ensure compatibility\n\tif header[0] != socks5Version {\n\t\treturn nil, fmt.Errorf(\"Unsupported command version: %v\", header[0])\n\t}\n\n\t// Read in the destination address\n\tdest, err := readAddrSpec(bufConn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &Request{\n\t\tVersion:  socks5Version,\n\t\tCommand:  header[1],\n\t\tDestAddr: dest,\n\t\tbufConn:  bufConn,\n\t}, nil\n}\n\nfunc sendReply(w io.Writer, resp uint8, addr *AddrSpec) error {\n\tvar addrType uint8","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request.go#L66-L102","documentation":"socks.NewRequest reads the first 3 bytes of a SOCKS5 connection and checks that the version byte is socks5Version (0x05). If the client sends a different protocol version byte, the library refuses to parse the request and returns this error. It guards against speaking to non-SOCKS5 or SOCKS4 clients on a SOCKS5 listener.","triggerScenarios":"Calling socks.NewRequest (directly or via RequestHandler.Serve) on a connection whose first byte is not 0x05 — e.g. a SOCKS4/4a client, plain HTTP traffic, TLS traffic, or garbage bytes hitting the SOCKS port.","commonSituations":"A proxy client misconfigured to use SOCKS4 instead of SOCKS5; an HTTP proxy client pointed at a SOCKS5 port; a port scanner or load-balancer health check probing the listener; a TLS-wrapped client connecting to a plaintext SOCKS port.","solutions":["Reconfigure the client to use SOCKS5 (version 0x05) protocol","Verify nothing else (HTTP proxy, TLS terminator, health checks) is pointing at the SOCKS listener port","If you must accept legacy clients, read the version byte yourself and reject/pre-process before calling NewRequest","Check that no proxy chaining step strips or rewrites the greeting bytes"],"exampleFix":"// before: client configured with SOCKS4\nproxy.setScheme(\"socks4\")\n\n// after\nproxy.setScheme(\"socks5\") // sends version byte 0x05","handlingStrategy":"validation","validationCode":"// client side: ensure the first greeting byte is SOCKS5 (0x05)\nif ver := 0x05; ver != socks5Version {\n    return fmt.Errorf(\"client must speak SOCKS5, got version %d\", ver)\n}","typeGuard":"func isSOCKS5Conn(firstByte byte) bool { return firstByte == 0x05 }","tryCatchPattern":"if err := serveSOCKS(conn); err != nil {\n    if strings.Contains(err.Error(), \"Unsupported command version\") {\n        log.Warn().Msg(\"non-SOCKS5 client on SOCKS port; check client proxy scheme\")\n    }\n}","preventionTips":["Always configure clients with scheme socks5://, never socks4:// or http:// on a SOCKS5 port","Keep health probes off the SOCKS listener or make them protocol-aware","Rate-limit/log pre-handshake failures to spot scanners early"],"tags":["network","socks5","protocol-version"],"backgroundTag":"invalid-enum-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}