{"record":{"id":"3f9b93eb53f2efea","repo":"golang/go","slug":"tls-unknown-session-encoding","errorCode":null,"errorMessage":"tls: unknown session encoding","messagePattern":"tls: unknown session encoding","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/ticket.go","lineNumber":218,"sourceCode":"\t\t!s.ReadUint8(&earlyData) ||\n\t\tlen(ss.secret) == 0 ||\n\t\t!unmarshalCertificate(&s, &cert) {\n\t\treturn nil, errors.New(\"tls: invalid session encoding\")\n\t}\n\tfor !extra.Empty() {\n\t\tvar e []byte\n\t\tif !readUint24LengthPrefixed(&extra, &e) {\n\t\t\treturn nil, errors.New(\"tls: invalid session encoding\")\n\t\t}\n\t\tss.Extra = append(ss.Extra, e)\n\t}\n\tswitch typ {\n\tcase 1:\n\t\tss.isClient = false\n\tcase 2:\n\t\tss.isClient = true\n\tdefault:\n\t\treturn nil, errors.New(\"tls: unknown session encoding\")\n\t}\n\tswitch extMasterSecret {\n\tcase 0:\n\t\tss.extMasterSecret = false\n\tcase 1:\n\t\tss.extMasterSecret = true\n\tdefault:\n\t\treturn nil, errors.New(\"tls: invalid session encoding\")\n\t}\n\tswitch earlyData {\n\tcase 0:\n\t\tss.EarlyData = false\n\tcase 1:\n\t\tss.EarlyData = true\n\tdefault:\n\t\treturn nil, errors.New(\"tls: invalid session encoding\")\n\t}\n\tfor _, cert := range cert.Certificate {","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/ticket.go#L200-L236","documentation":"Returned by ParseSessionState (ticket.go:218) when the single-byte 'typ' field is neither 1 (server session) nor 2 (client session). The encoding scheme reserves exactly those two values; anything else means the blob was produced by an unknown/future encoder or is corrupt.","triggerScenarios":"Deserializing a session blob whose type byte is 0 or >=3. Happens when the blob was written by a newer Go that extended the type namespace, or when random/corrupt bytes happen to pass the earlier structural reads.","commonSituations":"Forward-incompatibility: reading a session state produced by a newer Go version that added a new type byte; cache pollution with non-session bytes; mismatched endianness when blobs were transferred between big-endian/little-endian stores.","solutions":["Treat as an unsupported/corrupt blob: drop it and do a full handshake.","Version-gate persisted session blobs and refuse blobs from newer Go versions.","Clear the session cache after upgrading or downgrading Go."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"ss, err := tls.ParseSessionState(data)\nif err != nil {\n    // Unknown type byte means newer/foreign encoding. Drop and re-handshake.\n    cache.Delete(key)\n    return nil\n}","preventionTips":["Do not share persisted session blobs across Go major versions.","Invalidate caches on toolchain upgrade/downgrade.","Refuse to load blobs lacking a version tag you recognize."],"tags":["tls","session-resumption","version-compat","corruption"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}