{"record":{"id":"2b076bffbe2753a4","repo":"gchq/CyberChef","slug":"not-enough-data-in-server-hello","errorCode":null,"errorMessage":"Not enough data in Server Hello.","messagePattern":"Not enough data in Server Hello\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JA3SFingerprint.mjs","lineNumber":82,"sourceCode":"            throw new OperationError(\"Not handshake data.\");\n\n        // Version\n        s.moveForwardsBy(2);\n\n        // Length\n        const length = s.readInt(2);\n        if (s.length !== length + 5)\n            throw new OperationError(\"Incorrect handshake length.\");\n\n        // Handshake type\n        const handshakeType = s.readInt(1);\n        if (handshakeType !== 2)\n            throw new OperationError(\"Not a Server Hello.\");\n\n        // Handshake length\n        const handshakeLength = s.readInt(3);\n        if (s.length !== handshakeLength + 9)\n            throw new OperationError(\"Not enough data in Server Hello.\");\n\n        // Hello version\n        const helloVersion = s.readInt(2);\n\n        // Random\n        s.moveForwardsBy(32);\n\n        // Session ID\n        const sessionIDLength = s.readInt(1);\n        s.moveForwardsBy(sessionIDLength);\n\n        // Cipher suite\n        const cipherSuite = s.readInt(2);\n\n        // Compression Method\n        s.moveForwardsBy(1);\n\n        // Extensions","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JA3SFingerprint.mjs#L64-L100","documentation":"JA3SFingerprint reads the 3-byte handshake length and requires total stream length === handshakeLength + 9. A mismatch means the ServerHello body is truncated or carries extra bytes. readInt returning undefined on short input also satisfies the !== check.","triggerScenarios":"A truncated ServerHello (missing session ID / cipher suite / compression / extensions), a handshake length field corrupted by inputFormat mismatch, or extra bytes inside the declared record length. Parsing of the body fields has not started, so this is purely a size check.","commonSituations":"Truncated paste of a ServerHello, capture missing the extensions tail, inputFormat mismatch corrupting the 3-byte length, or an unusual TLS 1.3 ServerHello layout.","solutions":["Ensure the full ServerHello body is present (handshakeLength bytes after the 4-byte handshake header).","Match inputFormat so the 3-byte length is correct.","Re-capture the ServerHello including all extensions.","Trim the input to exactly handshakeLength + 9 bytes."],"exampleFix":"// before\nja3s.run(truncatedServerHello, ['Hex','Base64']); // length mismatch -> Not enough data.\n// after\nconst full = await recaptureFullServerHello();\nja3s.run(full, ['Hex','Base64']);","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertFullServerHello(input, inputFormat) {\n  const b = Utils.convertToByteArray(input, inputFormat);\n  if (b.length < 9) throw new Error('record too short for handshake header');\n  const hsLen = (b[6] << 16) | (b[7] << 8) | b[8];\n  if (b.length !== hsLen + 9) {\n    throw new Error(`Stream length ${b.length} != handshake length ${hsLen}+9. ServerHello is truncated or has extra bytes.`);\n  }\n  return b;\n}","typeGuard":"function isCompleteServerHello(bytes) {\n  if (bytes.length < 9) return false;\n  const hsLen = (bytes[6] << 16) | (bytes[7] << 8) | bytes[8];\n  return bytes[0] === 0x16 && bytes[5] === 2 && bytes.length === hsLen + 9;\n}","tryCatchPattern":null,"preventionTips":["Ensure the full ServerHello body (incl. extensions) is present.","Match inputFormat so the 3-byte length is correct.","Re-capture if extensions are missing.","Trim input to exactly handshakeLength + 9 bytes."],"tags":["tls","network","parsing","cyberchef","input-validation","ja3s"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}