{"record":{"id":"73d55d480c91255d","repo":"projectdiscovery/nuclei","slug":"mysql-handshake-packet-length-out-of-range","errorCode":null,"errorMessage":"mysql handshake packet length out of range","messagePattern":"mysql handshake packet length out of range","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mysql/fingerprint.go","lineNumber":233,"sourceCode":"\t}\n\n\t// Phase 2: best-effort enrichment. Failures here must not drop Version.\n\tenrichMySQLHandshake(&info, packet, versionEnd)\n\treturn info, nil\n}\n\n// detectMySQLVersion mirrors fingerprintx CheckInitialHandshakePacket so we\n// accept the same greetings and always surface the server version string.\nfunc detectMySQLVersion(packet []byte) (string, int, error) {\n\tif len(packet) < 35 {\n\t\treturn \"\", 0, fmt.Errorf(\"mysql handshake packet too short\")\n\t}\n\n\t// fingerprintx treats bytes[0:4] as little-endian length (seq usually 0).\n\t// Use the real 3-byte MySQL length for bounds, but keep the same 25..4096 gate.\n\tlength := mysqlPacketLength(packet)\n\tif length < 25 || length > 4096 {\n\t\treturn \"\", 0, fmt.Errorf(\"mysql handshake packet length out of range\")\n\t}\n\tif packet[4] != mysqlProtocolVersion10 {\n\t\treturn \"\", 0, fmt.Errorf(\"unsupported mysql protocol version\")\n\t}\n\n\tversion, nullPos, err := readNullTerminatedASCIIString(packet, 5)\n\tif err != nil {\n\t\treturn \"\", 0, err\n\t}\n\t// nullPos points at the NUL; fingerprintx filler is at nullPos+13.\n\tfillerPos := nullPos + 13\n\tif fillerPos >= len(packet) {\n\t\treturn \"\", 0, fmt.Errorf(\"mysql handshake missing filler byte\")\n\t}\n\tif packet[fillerPos] != 0x00 {\n\t\treturn \"\", 0, fmt.Errorf(\"mysql handshake filler byte is not zero\")\n\t}\n\treturn version, nullPos + 1, nil","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mysql/fingerprint.go#L215-L251","documentation":"Beyond the 35-byte floor, the declared 3-byte payload length must lie in 25..4096 — the same gate fingerprintx applies to initial handshake packets. This error means the length field decoded below 25 (a handshake cannot fit) or above 4096 (no real greeting is that large), so the packet is not a credible MySQL handshake. It is raised by detectMySQLVersion and propagates out of FingerprintMySQL as a fingerprint failure.","triggerScenarios":"mysql.FingerprintMySQL against services whose first three bytes decode outside 25..4096 — common for non-MySQL protocols (HTTP, Redis 'RED', TLS records) — or a corrupted/shifted stream where the length is read from the wrong offset.","commonSituations":"Broad port scans hitting mysql templates on everything that answers; proxies inserting preamble bytes; pcap-replay fixtures missing the first bytes so the stream is desynchronized.","solutions":["Verify the service with nmap -sV or a manual banner read before fingerprinting","Confirm you reached the database directly, not through a proxy that prepends bytes","If TLS is enforced on the MySQL port, use an SSL/TLS probe instead of the mysql fingerprint","Wrap FingerprintMySQL in try/catch in the template and continue on failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// restrict fingerprinting to known-database ports to avoid non-mysql byte streams\nif (!isLikelyDbPort(port)) { log('skip mysql fingerprint on ' + port); return; }","typeGuard":null,"tryCatchPattern":"try { const info = mysql.FingerprintMySQL(host, port); }\ncatch (e) { if (String(e).includes('packet length out of range')) log('non-mysql stream on ' + host + ':' + port); else throw e; }","preventionTips":["Expect length-gate failures on HTTP/TLS/Redis ports — classify, do not retry","Verify with nmap -sV before trusting a mysql template result","Ensure direct (non-proxied) access to the database port"],"tags":["mysql","protocol-parsing","fingerprint","packet-length","network","go"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}