{"record":{"id":"74d150f78cd0e38e","repo":"jdx/mise","slug":"encrypted-payload-exceeds-the-size-limit","errorCode":null,"errorMessage":"encrypted payload exceeds the size limit","messagePattern":"encrypted payload exceeds the size limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/agecrypt.rs","lineNumber":171,"sourceCode":"    if recipients.is_empty() {\n        bail!(\"no age recipients to encrypt for\");\n    }\n    if plaintext.len() as u64 > MAX_PLAINTEXT_BYTES {\n        bail!(\"plaintext exceeds the size limit\");\n    }\n    let compressed = zstd::encode_all(plaintext, ZSTD_COMPRESSION_LEVEL)?;\n    if compressed.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"compressed payload exceeds the size limit\");\n    }\n    let encryptor =\n        Encryptor::with_recipients(recipients.iter().map(|r| r.as_ref() as &dyn Recipient))\n            .map_err(|e| eyre!(\"creating the age encryptor: {e}\"))?;\n    let mut out = Vec::new();\n    let mut writer = encryptor.wrap_output(&mut out)?;\n    writer.write_all(&compressed)?;\n    writer.finish()?;\n    if out.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted payload exceeds the size limit\");\n    }\n    Ok(out)\n}\n\npub(crate) async fn decrypt_bytes_mode(\n    ciphertext: &[u8],\n    interactive: bool,\n) -> Result<Vec<u8>, DecryptError> {\n    if ciphertext.len() as u64 > MAX_ENCRYPTED_BYTES {\n        return Err(DecryptError::Corrupt(\n            \"encrypted payload exceeds the size limit\".into(),\n        ));\n    }\n    let loaded = load_identities(interactive).await;\n    if loaded.identities.is_empty() {\n        if loaded.plugins > 0 {\n            return Err(DecryptError::Failed { error: \"hardware identity requires an interactive restore with its age plugin installed\".into(), hint: String::new() });\n        }","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/agecrypt.rs#L153-L189","documentation":"agecrypt refuses to return an encrypted payload larger than MAX_ENCRYPTED_BYTES. After encrypting (and compressing) the input bytes, the resulting ciphertext is measured; if it exceeds the configured limit the whole encryption is discarded and the error is thrown. This guards against unexpectedly large or incompressible inputs blowing up storage/protocol message limits.","triggerScenarios":"Calling encrypt_bytes with input whose compressed-then-age-encrypted output exceeds MAX_ENCRYPTED_BYTES. Common with large binaries or already-compressed data (images, archives, videos) where compression gains nothing and the payload stays oversized.","commonSituations":"Embedding a large file into the plugin protocol payload; encrypting secrets that include an accidentally-inlined blob; data that grew after a format change so the old size assumption no longer holds.","solutions":["Shrink the input before encryption: strip or split unnecessary data so the encrypted output fits under MAX_ENCRYPTED_BYTES","Store large payloads out-of-band (e.g. on disk or in object storage) and encrypt only a reference or key material","Check out.len() against MAX_ENCRYPTED_BYTES before calling, or catch this error and surface a user-facing 'payload too large' message","If the limit is legitimately too low for your use case, propose raising MAX_ENCRYPTED_BYTES upstream rather than bypassing the check"],"exampleFix":"// before\nlet blob = std::fs::read(\"huge-dump.bin\")?;\nlet ct = encrypt_bytes(&blob, recipients).await?; // bails: encrypted payload exceeds the size limit\n// after\nlet blob = std::fs::read(\"huge-dump.bin\")?;\nif blob.len() as u64 > MAX_ENCRYPTED_BYTES {\n    anyhow::bail!(\"input too large to encrypt inline; store it externally\");\n}\nlet ct = encrypt_bytes(&blob, recipients).await?;","handlingStrategy":"validation","validationCode":"if (input.len() as u64 > MAX_ENCRYPTED_BYTES) {\n    return Err(anyhow!(\"input {} bytes exceeds encrypt limit {}\", input.len(), MAX_ENCRYPTED_BYTES));\n}","typeGuard":null,"tryCatchPattern":"match encrypt_bytes(&data, &recipients).await {\n    Ok(ct) => use_ciphertext(ct),\n    Err(e) if e.to_string().contains(\"exceeds the size limit\") => handle_oversized_payload(),\n    Err(e) => return Err(e),\n}","preventionTips":["Estimate worst-case ciphertext size (age overhead ~ a few hundred bytes plus input) before encrypting","Compress data yourself first and measure; already-compressed data won't shrink","Keep large blobs out of the encrypted protocol payload; encrypt references/keys instead","Add a unit test asserting representative payloads stay under MAX_ENCRYPTED_BYTES"],"tags":["encryption","size-limit","payload"],"backgroundTag":"payload-too-large","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}