{"record":{"id":"3919763ff6632624","repo":"projectdiscovery/nuclei","slug":"response-read-size-must-be-non-negative","errorCode":null,"errorMessage":"response read size must be non-negative","messagePattern":"response read size must be non-negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/config.go","lineNumber":169,"sourceCode":"\t\t\treturn errors.New(\"probe concurrency must be at least 1\")\n\t\t}\n\t\te.opts.TemplateThreads = opts.TemplateConcurrency\n\t\te.opts.BulkSize = opts.HostConcurrency\n\t\te.opts.HeadlessBulkSize = opts.HeadlessHostConcurrency\n\t\te.opts.HeadlessTemplateThreads = opts.HeadlessTemplateConcurrency\n\t\te.opts.JsConcurrency = opts.JavascriptTemplateConcurrency\n\t\te.opts.PayloadConcurrency = opts.TemplatePayloadConcurrency\n\t\te.opts.ProbeConcurrency = opts.ProbeConcurrency\n\t\treturn nil\n\t}\n}\n\n// WithResponseReadSize sets the maximum size of response to read in bytes.\n// A value of 0 means no limit. Recommended values: 1MB (1048576) to 10MB (10485760).\nfunc WithResponseReadSize(responseReadSize int) NucleiSDKOptions {\n\treturn func(e *NucleiEngine) error {\n\t\tif responseReadSize < 0 {\n\t\t\treturn errors.New(\"response read size must be non-negative\")\n\t\t}\n\t\te.opts.ResponseReadSize = responseReadSize\n\t\treturn nil\n\t}\n}\n\n// WithGlobalRateLimit sets global rate (i.e all hosts combined) limit options\n// Deprecated: will be removed in favour of WithGlobalRateLimitCtx in next release\nfunc WithGlobalRateLimit(maxTokens int, duration time.Duration) NucleiSDKOptions {\n\treturn WithGlobalRateLimitCtx(context.Background(), maxTokens, duration)\n}\n\n// WithGlobalRateLimitCtx allows setting a global rate limit for the entire engine\nfunc WithGlobalRateLimitCtx(ctx context.Context, maxTokens int, duration time.Duration) NucleiSDKOptions {\n\treturn func(e *NucleiEngine) error {\n\t\te.opts.RateLimit = maxTokens\n\t\te.opts.RateLimitDuration = duration\n\t\te.rateLimiter = utils.GetRateLimiter(ctx, e.opts.RateLimit, e.opts.RateLimitDuration)","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/lib/config.go#L151-L187","documentation":"The first non-annotation line of a raw request is split on single spaces and must yield at least three fields (method, target, protocol). Shorter lines - missing HTTP version or missing method - are rejected as malformed before any URL parsing or network work happens.","triggerScenarios":"A request line like 'GET /path' (no HTTP/1.1) or '/path HTTP/1.1' (no method); lines mangled by formatting so fields merge or vanish.","commonSituations":"Hand-edited templates; converting curl commands and dropping the version token; OCR or copy artifacts.","solutions":["Write the full request line: GET /path HTTP/1.1","Keep annotations on their own @-prefixed lines above it","Avoid stray spacing that changes the field count","Run nuclei -validate on the template"],"exampleFix":"# before\nGET {{BaseURL}}\n# after\nGET {{BaseURL}} HTTP/1.1","handlingStrategy":"validation","validationCode":"import (\n    \"regexp\"\n    \"strings\"\n)\n\nvar requestLineRe = regexp.MustCompile(`^\\S+ \\S+ \\S+`)\n\nfunc validRequestLine(line string) bool {\n    return requestLineRe.MatchString(strings.TrimSpace(line))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write METHOD TARGET HTTP/1.1","Put @annotations on their own lines","Validate with nuclei -validate"],"tags":["http","raw-request","parsing","template"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}