{"record":{"id":"2cdb175fa3118e3d","repo":"Pumpkin-MC/Pumpkin","slug":"jwt-length-jwt-len-exceeds-limit-max-packet-dat","errorCode":null,"errorMessage":"JWT length {jwt_len} exceeds limit {MAX_PACKET_DATA_SIZE}","messagePattern":"JWT length (.+?) exceeds limit (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/pumpkin-protocol/src/bedrock/server/login.rs","lineNumber":33,"sourceCode":"    pub raw_token: Vec<u8>,\n}\n\nimpl PacketRead for SLogin {\n    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {\n        let protocol_version = i32::read_be(reader)?;\n        let connection_request_len = VarUInt::read(reader)?.0 as usize;\n        if connection_request_len > MAX_PACKET_DATA_SIZE {\n            return Err(Error::new(\n                ErrorKind::InvalidData,\n                format!(\n                    \"Connection request length {connection_request_len} exceeds limit {MAX_PACKET_DATA_SIZE}\"\n                ),\n            ));\n        }\n\n        let jwt_len = u32::read(reader)? as usize;\n        if jwt_len > MAX_PACKET_DATA_SIZE {\n            return Err(Error::new(\n                ErrorKind::InvalidData,\n                format!(\"JWT length {jwt_len} exceeds limit {MAX_PACKET_DATA_SIZE}\"),\n            ));\n        }\n        let mut jwt = vec![0; jwt_len];\n        reader.read_exact(&mut jwt)?;\n\n        let raw_token_len = u32::read(reader)? as usize;\n        if raw_token_len > MAX_PACKET_DATA_SIZE {\n            return Err(Error::new(\n                ErrorKind::InvalidData,\n                format!(\"Raw token length {raw_token_len} exceeds limit {MAX_PACKET_DATA_SIZE}\"),\n            ));\n        }\n        let mut raw_token = vec![0; raw_token_len];\n        reader.read_exact(&mut raw_token)?;\n\n        Ok(Self {","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/bedrock/server/login.rs#L15-L51","documentation":"Thrown when the u32-length-prefixed JWT chain blob inside the Bedrock Login packet declares a length greater than MAX_PACKET_DATA_SIZE. The guard prevents allocating an unbounded buffer from untrusted input. The login is rejected with an InvalidData error before authentication can proceed.","triggerScenarios":"A client sends a Login packet with a JWT-length field exceeding MAX_PACKET_DATA_SIZE; occurs with malformed packets, crafted DoS attempts, or a desynchronized stream misinterpreting subsequent bytes as the length.","commonSituations":"Hostile clients probing the login path, proxy corruption, or protocol drift between client and server changing the expected layout.","solutions":["Confirm client/server protocol versions match","Inspect the raw login packet to verify the JWT length field value","If a legitimate deployment needs larger tokens, raise MAX_PACKET_DATA_SIZE","Ensure encryption at the raknet layer isn't corrupting the stream"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fn jwt_len_ok(len: usize) -> bool { len <= MAX_PACKET_DATA_SIZE }","typeGuard":"fn bounded(len: u32) -> Option<usize> { usize::try_from(len).ok().filter(|&l| l <= MAX_PACKET_DATA_SIZE) }","tryCatchPattern":"if let Err(e) = SLogin::read(reader) {\n    if e.to_string().contains(\"JWT length\") { drop(peer); return Ok(()); }\n    return Err(e.into());\n}","preventionTips":["Validate every length prefix in the login packet before allocation","Ensure login tokens arrive over an authenticated raknet connection, not raw UDP","Alert on peers repeatedly sending oversized JWT lengths"],"tags":["protocol","bedrock","login","jwt","size-limit"],"backgroundTag":"payload-too-large","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}