{"record":{"id":"84194616bf64772f","repo":"projectdiscovery/nuclei","slug":"mysql-error-packet-truncated","errorCode":null,"errorMessage":"mysql error packet truncated","messagePattern":"mysql error packet truncated","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mysql/fingerprint.go","lineNumber":181,"sourceCode":"\nfunc parseMySQLGreeting(packet []byte) (HandshakeInfo, error) {\n\tif len(packet) < 5 {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql packet too short\")\n\t}\n\tif packet[4] == mysqlErrorHeader {\n\t\treturn parseMySQLErrorPacket(packet)\n\t}\n\treturn parseMySQLHandshakePacket(packet)\n}\n\nfunc parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {\n\t// Stay compatible with fingerprintx error detection: minimum size and 0xff header.\n\tif len(packet) < 8 {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet too short\")\n\t}\n\tlength := mysqlPacketLength(packet)\n\tif length < 3 || length+4 > len(packet) {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet truncated\")\n\t}\n\tif packet[4] != mysqlErrorHeader {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet has invalid header\")\n\t}\n\n\tinfo := HandshakeInfo{\n\t\tPacketType: \"error\",\n\t\tErrorCode:  int(binary.LittleEndian.Uint16(packet[5:7])),\n\t}\n\tmsgStart := 7\n\t// Protocol 4.1 error packets may include '#' + 5-byte SQLSTATE.\n\tif 4+length > 8 && packet[7] == '#' && 4+length >= 13 {\n\t\tmsgStart = 13\n\t}\n\tif msgStart < 4+length {\n\t\tinfo.ErrorMessage = readPrintableASCII(packet[msgStart : 4+length])\n\t}\n\treturn info, nil","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mysql/fingerprint.go#L163-L199","documentation":"For an ERR packet, the declared 3-byte payload length must be at least 3 (0xff + 2-byte error code) and the header plus payload must fit inside the received bytes (length+4 <= len(packet)). This error means the length field says the error payload is smaller than the minimum or larger than what actually arrived — a self-inconsistent packet. It keeps nuclei compatible with fingerprintx's error-packet validation.","triggerScenarios":"mysql.FingerprintMySQL against a peer whose ERR packet declares a payload < 3 bytes or claims more bytes than were delivered — truncated TCP reads, proxies rewriting lengths, or malformed emulators.","commonSituations":"Connections cut mid-packet by firewalls; test fixtures with mismatched length fields; protocol fuzzing corpora.","solutions":["Capture the full exchange (tcpdump -i any port 3306 -w out.pcap) and compare the declared length with actual bytes","Rule out middleboxes by connecting directly to the DB host","Treat as a failed fingerprint and fall back to generic service detection","In fixtures, keep the 3-byte length consistent with the payload you appended"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { const info = mysql.FingerprintMySQL(host, port); }\ncatch (e) { if (String(e).includes('mysql error packet truncated')) log('inconsistent ERR packet from ' + host); else throw e; }","preventionTips":["Keep fixture length fields consistent with payload size","Capture pcaps when a specific host persistently fails to spot middlebox rewrites"],"tags":["mysql","protocol-parsing","fingerprint","packet-length","truncated-response","go"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}