{"record":{"id":"50e76d39ac5f4158","repo":"jdx/mise","slug":"registry-archive-contains-too-many-entries","errorCode":null,"errorMessage":"registry archive contains too many entries","messagePattern":"registry archive contains too many entries","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/registry.rs","lineNumber":372,"sourceCode":"            .to_string();\n        let mut source = String::new();\n        entry.read_to_string(&mut source)?;\n        sources.insert(short, source);\n    }\n\n    ensure!(\n        !sources.is_empty(),\n        \"archive does not contain registry entries\"\n    );\n    registry_from_sources(sources)\n}\n\nfn track_registry_archive_entry(\n    index: usize,\n    entry_size: u64,\n    archive_size: &mut u64,\n) -> Result<()> {\n    ensure!(\n        index < MAX_REGISTRY_ARCHIVE_ENTRIES,\n        \"registry archive contains too many entries\"\n    );\n    ensure!(\n        entry_size <= MAX_REGISTRY_ARCHIVE_ENTRY_SIZE,\n        \"registry archive entry is too large\"\n    );\n    *archive_size = archive_size\n        .checked_add(entry_size)\n        .ok_or_else(|| eyre::eyre!(\"registry archive size overflow\"))?;\n    ensure!(\n        *archive_size <= MAX_REGISTRY_ARCHIVE_SIZE,\n        \"registry archive is too large\"\n    );\n    Ok(())\n}\n\nfn registry_from_sources(sources: BTreeMap<String, String>) -> Result<Registry> {","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/registry.rs#L354-L390","documentation":"To bound memory and CPU during registry archive loading, mise caps the number of archive entries at MAX_REGISTRY_ARCHIVE_ENTRIES (4096). An archive whose entry index reaches this limit is rejected outright as a DoS guard, independent of individual entry sizes.","triggerScenarios":"Loading a registry archive that contains 4096 or more entries — either a legitimately huge registry release or an archive padded with thousands of small files (test fixtures, docs, images).","commonSituations":"Upstream registry release that grew beyond the cap; archives built from a repository checkout rather than a curated set of registry files; a malicious/zip-bomb-style archive designed to exhaust resources.","solutions":["Use the curated registry archive (or strip non-registry files) so the entry count stays under 4096","Split an oversized registry into multiple archives and load them separately if supported","If upstream legitimately outgrew the cap, upgrade mise (the limit may have been raised) or file an issue to raise MAX_REGISTRY_ARCHIVE_ENTRIES"],"exampleFix":"// before (repo checkout archive with 12k files)\nmise registry-load --archive ./repo-snapshot.tar.gz\n// after\nmise registry-load --archive ./registry-4096max.tar.gz  # curated entries only","handlingStrategy":"validation","validationCode":"const n = await countArchiveEntries(archivePath);\nif (n >= 4096) throw new Error(`archive has ${n} entries; mise caps at 4096`);","typeGuard":null,"tryCatchPattern":"try { await loadRegistryArchive(path); } catch (e) {\n  if (String(e).includes('too many entries')) {\n    console.error('Registry archive exceeds the 4096-entry cap; use the curated archive or split it.');\n    return null;\n  }\n  throw e;\n}","preventionTips":["Ship curated registry archives, not whole repo snapshots","Monitor registry entry counts as the registry grows","Prefer a registry split before hitting the cap"],"tags":["registry","archive","resource-limit","payload-too-large"],"backgroundTag":"payload-too-large","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}