{"record":{"id":"93440b988eed0c35","repo":"gravitational/teleport","slug":"distinguished-name-too-large-refusing-to-parse","errorCode":null,"errorMessage":"distinguished name too large, refusing to parse","messagePattern":"distinguished name too large, refusing to parse","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"api/utils/pkixname/parser.go","lineNumber":58,"sourceCode":"//     2.5.4.10, etc.\n//   - Hexstrings are not supported (ie, \"#1234ABCD\"). Custom OIDs values must\n//     be strings.\n//   - Attribute types may not be prefixed with \"oid.\" or \"OID.\".\n//   - Escaped characters are limited to specials and the space character (' ').\n//     No other escapes are allowed, including hex escaping.\n//   - Multi-valued RDNs are only allowed if all values refer to the same\n//     attributeType.\n//   - The only character interpreted as whitespace is the space character\n//     (' ').\n//\n// Reference: https://www.rfc-editor.org/rfc/rfc2253.\nfunc ParseDistinguishedName(dn string) (*pkix.Name, error) {\n\tconst maxDNLength = 4096 // arbitrary-ish upper value\n\tswitch {\n\tcase dn == \"\": // Early exit.\n\t\treturn &pkix.Name{}, nil\n\tcase len(dn) > maxDNLength:\n\t\treturn nil, errors.New(\"distinguished name too large, refusing to parse\")\n\t}\n\n\ttokens, err := tokenize(dn)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tdst := &pkix.Name{}\n\tif tokens.Len() == 0 {\n\t\treturn dst, nil\n\t}\n\tif err := parseRDNSequence(dst, *tokens); err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed RDNs: %w\", err)\n\t}\n\treturn dst, nil\n}\n\n// parseRDNSequence parses a RelativeDistinguishedName sequence, ie, a sequence","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L40-L76","documentation":"ParseDistinguishedName rejects X.509 distinguished name strings longer than 4096 characters (maxDNLength, an arbitrary safety cap) before tokenizing. This guards the parser against pathological or maliciously oversized DN input that could exhaust resources or blow past downstream limits.","triggerScenarios":"Calling ParseDistinguishedName (directly or via callers like Run / anonymous wrappers parsing cert subjects) with a DN string whose length exceeds 4096 characters.","commonSituations":"Feeding certificates or config values with extremely long organizational attributes; fuzzing/attacker-supplied SAML or cert subjects; accidental concatenation of multiple DNs into one string.","solutions":["Shorten the DN: remove or abbreviate excessive attributes so it is under 4096 characters, then re-parse.","Trim/clean the input upstream (strip whitespace, duplicate RDNs, or joined DN strings) before calling ParseDistributedName.","If you legitimately need larger DNs, treat this as a hard limit and reject the certificate/config early with a clear validation message rather than bypassing the parser."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(dn) > 4096 { return fmt.Errorf(\"DN too long (%d > 4096)\", len(dn)) }\nif dn == \"\" { return pkix.Name{} }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize cert subjects/config DNs before parsing (trim whitespace, drop duplicate RDNs).","Enforce a sane DN length limit at ingestion time with a clear user-facing error.","Treat oversized DNs as suspicious input in security-sensitive paths and log/reject them."],"tags":["x509","parsing","input-validation"],"backgroundTag":"input-too-large","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}