{"record":{"id":"594a35738522944f","repo":"golang/go","slug":"tls-tls-1-3-client-supports-illegal-compression-m","errorCode":null,"errorMessage":"tls: TLS 1.3 client supports illegal compression methods","messagePattern":"tls: TLS 1\\.3 client supports illegal compression methods","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server_tls13.go","lineNumber":146,"sourceCode":"\t// TLS 1.2, because a TLS 1.3 server would abort here. The situation before\n\t// supported_versions was not better because there was just no way to do a\n\t// TLS 1.4 handshake without risking the server selecting TLS 1.3.\n\tfor _, id := range hs.clientHello.cipherSuites {\n\t\tif id == TLS_FALLBACK_SCSV {\n\t\t\t// Use c.vers instead of max(supported_versions) because an attacker\n\t\t\t// could defeat this by adding an arbitrary high version otherwise.\n\t\t\tif c.vers < c.config.maxSupportedVersion(roleServer, c.quic != nil) {\n\t\t\t\tc.sendAlert(alertInappropriateFallback)\n\t\t\t\treturn errors.New(\"tls: client using inappropriate protocol fallback\")\n\t\t\t}\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif len(hs.clientHello.compressionMethods) != 1 ||\n\t\ths.clientHello.compressionMethods[0] != compressionNone {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: TLS 1.3 client supports illegal compression methods\")\n\t}\n\n\ths.hello.random = make([]byte, 32)\n\tif _, err := io.ReadFull(c.config.rand(), hs.hello.random); err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err\n\t}\n\n\tif len(hs.clientHello.secureRenegotiation) != 0 {\n\t\tc.sendAlert(alertHandshakeFailure)\n\t\treturn errors.New(\"tls: initial handshake had non-empty renegotiation extension\")\n\t}\n\n\tif hs.clientHello.earlyData && c.quic != nil {\n\t\tif len(hs.clientHello.pskIdentities) == 0 {\n\t\t\tc.sendAlert(alertIllegalParameter)\n\t\t\treturn errors.New(\"tls: early_data without pre_shared_key\")\n\t\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server_tls13.go#L128-L164","documentation":"TLS 1.3 (RFC 8446 §4.1.2) requires the ClientHello compression_methods contain exactly one entry, the null compression method (0). Compression was removed from TLS 1.3 because of CRIME-style attacks. Any other compression list (multiple methods, DEFLATE, or empty) is illegal and the server sends illegal_parameter.","triggerScenarios":"The client sends compression_methods with length != 1, or with a single method that is not compressionNone (0). Occurs with non-compliant or older TLS stacks that carry TLS 1.2 compression negotiation forward.","commonSituations":"Hand-rolled TLS clients, old TLS libraries, fuzzers, or a TLS 1.2 client stack that always advertises compression and is being offered against a TLS 1.3 server.","solutions":["Set ClientHello compression_methods to a single null (0x00) entry","Use a compliant TLS library rather than constructing the ClientHello by hand"],"exampleFix":"// before\nhello.compressionMethods = []byte{0x00, 0x01} // null + deflate\n\n// after\nhello.compressionMethods = []byte{0x00} // null only","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := tlsConn.Handshake(); err != nil {\n    if strings.Contains(err.Error(), \"illegal compression methods\") {\n        log.Printf(\"non-compliant client (bad compression) from %v\", remote)\n    }\n    c.Close()\n    return\n}","preventionTips":["Use a compliant TLS client library that sets compression_methods to [null]","When testing, validate your ClientHello against the RFC 8446 §4.1.2 layout"],"tags":["tls","go","handshake","compression","rfc8446","compliance","crime"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}