{"record":{"id":"9efe5f9f7124294d","repo":"shadow1ng/fscan","slug":"cassandra-frame-too-large-d","errorCode":null,"errorMessage":"cassandra frame too large: %d","messagePattern":"cassandra frame too large: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/cassandra.go","lineNumber":206,"sourceCode":"\n\tbuf := append(header, body...)\n\t_, err := conn.Write(buf)\n\treturn err\n}\n\nfunc cqlRecv(conn io.Reader) (byte, []byte, error) {\n\t// 读取 9 字节头部（响应也有额外标志字节）\n\theader := make([]byte, 9)\n\tif _, err := io.ReadFull(conn, header); err != nil {\n\t\treturn 0, nil, err\n\t}\n\topcode := header[4]\n\tbodyLen := int(binary.BigEndian.Uint32(header[5:9]))\n\tif bodyLen == 0 {\n\t\treturn opcode, []byte{}, nil\n\t}\n\tif bodyLen > maxCQLFrameBody {\n\t\treturn opcode, nil, fmt.Errorf(\"cassandra frame too large: %d\", bodyLen)\n\t}\n\tbody := make([]byte, bodyLen)\n\tif _, err := io.ReadFull(conn, body); err != nil {\n\t\treturn opcode, nil, err\n\t}\n\treturn opcode, body, nil\n}\n\nfunc validateCQLQueryResponse(opcode byte, body []byte) error {\n\tif opcode == cqlOpError {\n\t\treturn fmt.Errorf(\"cassandra query failed: %s\", string(body))\n\t}\n\tif opcode != cqlOpResult {\n\t\treturn fmt.Errorf(\"unexpected query opcode: %d\", opcode)\n\t}\n\treturn nil\n}\n","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/cassandra.go#L188-L224","documentation":"cqlRecv parsed the frame header and found a body length exceeding maxCQLFrameBody, the safety cap on Cassandra CQL frame sizes. It refuses to allocate/read the body and returns 'cassandra frame too large: %d' to protect against malicious or corrupt servers.","triggerScenarios":"Any caller of cqlRecv (doCassandraAuth, tryNoAuthConnection, identifyService) reads a header whose 4-byte body length field exceeds maxCQLFrameBody.","commonSituations":"Connecting to a non-Cassandra service that emits garbage interpreted as a huge length; stream desynchronization after a partial read; an extremely large server response exceeding the plugin's conservative cap.","solutions":["Verify the target is a genuine Cassandra node — a bogus huge length usually means the peer isn't speaking the CQL binary protocol.","If legitimate responses are being rejected, raise maxCQLFrameBody to a value at or above the server's native_transport_frame_size/max frame size.","Recover stream sync by reconnecting rather than continuing to read a desynchronized socket."],"exampleFix":"// before\nmaxCQLFrameBody = 256 * 1024 // rejects large legit frames\n// after\nmaxCQLFrameBody = 16 * 1024 * 1024 // matches server frame limit","handlingStrategy":"validation","validationCode":"// server max frame size in cassandra.yaml must be <= client cap\n// e.g. native_transport_max_frame_size_in_mb: 256\nif serverMaxFrameMB*1024*1024 > maxCQLFrameBody {\n    log.Printf(\"client frame cap too small: raise maxCQLFrameBody above %d\", serverMaxFrameMB*1024*1024)\n}","typeGuard":null,"tryCatchPattern":"opcode, body, err := cqlRecv(conn)\nif err != nil && strings.HasPrefix(err.Error(), \"cassandra frame too large\") {\n    return fmt.Errorf(\"peer sent oversized frame; not a Cassandra node or cap too low: %w\", err)\n}","preventionTips":["Set maxCQLFrameBody >= the server's native_transport_max_frame_size_in_mb.","Treat oversized frames as a strong signal the peer is not speaking CQL.","Reconnect after this error; never continue reading the same stream."],"tags":["cassandra","cql","protocol","frame-size"],"backgroundTag":"payload-too-large","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}