{"record":{"id":"72ee6d001f959f7e","repo":"projectdiscovery/nuclei","slug":"version-option-too-short","errorCode":null,"errorMessage":"VERSION option too short","messagePattern":"VERSION option too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mssql/fingerprint.go","lineNumber":235,"sourceCode":"\t\t\tif start < 8 || end > len(response) {\n\t\t\t\treturn out, fmt.Errorf(\"invalid PL option data range\")\n\t\t\t}\n\t\t\tdata = response[start:end]\n\t\t}\n\t\ttokens = append(tokens, optionToken{token: token, offset: offset, length: length, data: data})\n\t\tposition += 5\n\t}\n\tif position >= len(response) || response[position] != tdsTerminator {\n\t\treturn out, fmt.Errorf(\"missing PL option terminator\")\n\t}\n\tif len(tokens) == 0 {\n\t\treturn out, fmt.Errorf(\"no PL option tokens\")\n\t}\n\tif tokens[0].token != plTokenVersion {\n\t\treturn out, fmt.Errorf(\"first PL option must be VERSION\")\n\t}\n\tif len(tokens[0].data) < 4 {\n\t\treturn out, fmt.Errorf(\"VERSION option too short\")\n\t}\n\n\tout.MajorVersion = int(tokens[0].data[0])\n\tout.MinorVersion = int(tokens[0].data[1])\n\tout.BuildNumber = int(tokens[0].data[2])<<8 | int(tokens[0].data[3])\n\tout.Version = fmt.Sprintf(\"%d.%d.%d\", out.MajorVersion, out.MinorVersion, out.BuildNumber)\n\n\tfor _, tok := range tokens[1:] {\n\t\tswitch tok.token {\n\t\tcase plTokenEncryption:\n\t\t\tif len(tok.data) > 0 {\n\t\t\t\tout.Encryption = int(tok.data[0])\n\t\t\t\tout.EncryptionMode = encryptionModeName(tok.data[0])\n\t\t\t}\n\t\tcase plTokenInstOpt:\n\t\t\t// 0x00 means the instance name matched (or none was requested).\n\t\t\tout.InstanceMatches = len(tok.data) == 0 || tok.data[0] == 0\n\t\tcase plTokenMars:","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mssql/fingerprint.go#L217-L253","documentation":"The VERSION option carries exactly 4 bytes of data (major, minor, build high, build low) and the parser requires at least 4 bytes to fill MajorVersion/MinorVersion/BuildNumber. This error means the VERSION option's offset/length resolved to fewer than 4 bytes (a short length, or length 0 leaving data nil). It is wrapped with errNotMssql, so mssql.IsMssql yields false and mssql.FingerprintMssql yields 'not a mssql service: VERSION option too short'.","triggerScenarios":"mssql.FingerprintMssql / IsMssql against a reply whose first option is token 0x00 but declares length < 4 (or 0), so the version payload window is too small.","commonSituations":"Malformed emulators/honeypots; test fixtures with a VERSION option of length 0-3; desynchronized option tables where the first 5-byte entry is actually mid-data.","solutions":["Confirm the service is MSSQL with mssql.IsMssql or sqlcmd","Hex-dump the reply; check the first entry is 00 xx xx 04 00 (token 0, length 4) and its offset lands inside the packet","Compare with a known SQL Server's pre-login reply to spot the divergence","Skip mssql fingerprinting for this target and use alternate detection"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!mssql.IsMssql(host, port)) { return; }","typeGuard":null,"tryCatchPattern":"try { const info = mssql.FingerprintMssql(host, port); }\ncatch (e) { if (String(e).includes('VERSION option too short')) log('malformed VERSION option: ' + host); else throw e; }","preventionTips":["Gate on IsMssql; a short VERSION payload is a malformed-reply signature","Do not attempt credential attacks on hosts whose pre-login fails validation"],"tags":["mssql","tds","protocol-parsing","fingerprint","bounds-check","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}