{"record":{"id":"59b32debaa7fbeb5","repo":"cloudflare/cloudflared","slug":"unsupported-socks-version-v","errorCode":null,"errorMessage":"Unsupported SOCKS version: %v","messagePattern":"Unsupported SOCKS version: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/connection_handler.go","lineNumber":42,"sourceCode":"\treturn &StandardConnectionHandler{\n\t\trequestHandler: requestHandler,\n\t\tauthHandler:    NewAuthHandler(),\n\t}\n}\n\n// Serve process new connection created after calling `Accept()` in the standard library\nfunc (h *StandardConnectionHandler) Serve(c io.ReadWriter) error {\n\tbufConn := bufio.NewReader(c)\n\n\t// read the version byte\n\tversion := []byte{0}\n\tif _, err := bufConn.Read(version); err != nil {\n\t\treturn err\n\t}\n\n\t// ensure compatibility\n\tif version[0] != socks5Version {\n\t\treturn fmt.Errorf(\"Unsupported SOCKS version: %v\", version)\n\t}\n\n\t// handle auth\n\tif err := h.authHandler.Handle(bufConn, c); err != nil {\n\t\treturn err\n\t}\n\n\t// process command/request\n\treq, err := NewRequest(bufConn)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn h.requestHandler.Handle(req, c)\n}\n","sourceCodeStart":24,"sourceCodeEnd":58,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/connection_handler.go#L24-L58","documentation":"SOCKS connection handler Serve reads the first byte of the connection and requires it to be socks5Version (0x05). Any other value means the client is not speaking SOCKS5, so Serve returns this error before auth negotiation begins.","triggerScenarios":"A client sends an HTTP request, TLS ClientHello, or raw bytes to the SOCKS port; the first byte differs from 0x05.","commonSituations":"Pointing a browser at the port with plain HTTP proxy settings vs SOCKS5; port scanners or monitoring probes; client configured for SOCKS4.","solutions":["Configure the client to use SOCKS5 (not HTTP or SOCKS4) for the proxy port.","Confirm the port in client config matches the cloudflared SOCKS listener.","Filter or ignore noise from scanners/probes hitting the port.","Log the offending version byte to identify the client type."],"exampleFix":"// before\nconst proxy = \"http://localhost:1080\"\n// after\nconst proxy = \"socks5://localhost:1080\"","handlingStrategy":"validation","validationCode":"// client: ensure socks5 scheme\nu, _ := url.Parse(proxyURL)\nif u.Scheme != \"socks5\" && u.Scheme != \"socks5h\" { return errors.New(\"proxy must be socks5\") }","typeGuard":null,"tryCatchPattern":"if err := h.Serve(ctx, conn); err != nil {\n    if strings.Contains(err.Error(), \"Unsupported SOCKS version\") {\n        logger.Debug().Msg(\"non-SOCKS5 client connected to socks port\")\n    }\n    return err\n}","preventionTips":["Configure clients with socks5:// scheme, not http:// or socks4://","Confirm the port matches the SOCKS listener","Ignore/filter scanner traffic on the port","Document that only SOCKS5 is supported"],"tags":["socks5","protocol","handshake"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}