{"record":{"id":"294cf9a4100cf4d3","repo":"vectordotdev/vector","slug":"received-chunk-with-message-id-message-id-and-se","errorCode":null,"errorMessage":"Received chunk with message id {message_id} and sequence number {sequence_number} has an invalid total chunks value of {total_chunks}. It must be between 1 and {GELF_MAX_TOTAL_CHUNKS}.","messagePattern":"Received chunk with message id (.+?) and sequence number (.+?) has an invalid total chunks value of (.+?)\\. It must be between 1 and (.+?)\\.","errorType":"validation","errorClass":"ChunkedGelfDecoderError","httpStatus":null,"severity":"error","filePath":"lib/codecs/src/decoding/framing/chunked_gelf.rs","lineNumber":352,"sourceCode":"        // | 64 bits    | 8 bits          | 8 bits       | remaining bits       |\n        // +------------+-----------------+--------------+----------------------+\n        //\n        // As this codec is oriented for UDP, the chunks (datagrams) are not guaranteed to be received in order,\n        // nor to be received at all. So, we have to store the chunks in a buffer (state field) until we receive\n        // all the chunks of a message. When we receive all the chunks of a message, we can concatenate them\n        // and return the complete payload.\n\n        // We need 10 bytes to read the message id, sequence number and total chunks\n        ensure!(\n            chunk.remaining() >= 10,\n            InvalidChunkHeaderSnafu { header: chunk }\n        );\n\n        let message_id = chunk.get_u64();\n        let sequence_number = chunk.get_u8();\n        let total_chunks = chunk.get_u8();\n\n        ensure!(\n            total_chunks > 0 && total_chunks <= GELF_MAX_TOTAL_CHUNKS,\n            InvalidTotalChunksSnafu {\n                message_id,\n                sequence_number,\n                total_chunks\n            }\n        );\n\n        ensure!(\n            sequence_number < total_chunks,\n            InvalidSequenceNumberSnafu {\n                message_id,\n                sequence_number,\n                total_chunks\n            }\n        );\n\n        let mut state_lock = self.state.lock().expect(\"poisoned lock\");","sourceCodeStart":334,"sourceCodeEnd":370,"githubUrl":"https://github.com/vectordotdev/vector/blob/99894c8d8885659cc16efc39bd71f9fb3b59e296/lib/codecs/src/decoding/framing/chunked_gelf.rs#L334-L370","documentation":"In a chunked GELF datagram, the byte after the sequence number declares the total number of chunks for the message, and it must be between 1 and GELF_MAX_TOTAL_CHUNKS (128). If the byte is 0 or greater than 128, `InvalidTotalChunksSnafu` rejects the chunk with this message. This guards the reassembly buffer from absurd allocation sizes driven by corrupt or hostile datagrams.","triggerScenarios":"A datagram with magic `0x1e 0x0f` where the 10th byte (total chunks) is 0 or >128 — e.g. a sender that writes the count as a 16/32-bit integer instead of one byte, or arbitrary binary that collides with the magic bytes.","commonSituations":"Custom GELF chunker implementations that misplace the header layout; fuzzing/scanners hitting the UDP port; corrupted datagrams from a misbehaving Graylog forwarder.","solutions":["Compare the sender's chunk header layout byte-for-byte against the GELF chunking spec (8-byte id, 1-byte seq, 1-byte total).","If the sender legitimately needs >128 chunks, split messages further upstream so each message fits in ≤128 chunks.","Capture one failing datagram with tcpdump and hex-dump the first 10 bytes to confirm which side is wrong."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"Err(e) if e.to_string().contains(\"invalid total chunks value\") => {\n    metrics.counter(\"gelf_bad_total_chunks\", 1);\n    debug!(error = %e, \"discarding datagram with invalid total chunks\");\n}","preventionTips":["Unit-test sender chunking against the spec: total in 1..=128, one byte big-endian semantics.","Alert on the rate of framing errors per source; a spike usually means a bad sender build."],"tags":["gelf","udp","framing","validation","vector"],"backgroundTag":"gelf-total-chunks-invalid","analyzedSha":"99894c8d8885659cc16efc39bd71f9fb3b59e296","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}