{"record":{"id":"a47b25d58459cd91","repo":"projectdiscovery/nuclei","slug":"error-reading-response-v","errorCode":null,"errorMessage":"error reading response: %v","messagePattern":"error reading response: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":196,"sourceCode":"\tbinary.BigEndian.PutUint32(hb, uint32(len(b)))\n\tb = append(hb, b...)\n\n\t_, err := conn.Write(b)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error sending to KDC (%s): %v\", conn.RemoteAddr().String(), err)\n\t}\n\n\tsh := make([]byte, 4)\n\t_, err = conn.Read(sh)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response size header: %v\", err)\n\t}\n\ts := binary.BigEndian.Uint32(sh)\n\n\trb := make([]byte, s)\n\t_, err = io.ReadFull(conn, rb)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error reading response: %v\", err)\n\t}\n\tif len(rb) < 1 {\n\t\treturn r, fmt.Errorf(\"no response data from KDC %s\", conn.RemoteAddr().String())\n\t}\n\treturn rb, nil\n}\n\n// CheckKrbError checks if the response bytes from the KDC are a KRBError.\nfunc CheckKrbError(b []byte) ([]byte, error) {\n\tvar KRBErr messages.KRBError\n\tif err := KRBErr.Unmarshal(b); err == nil {\n\t\treturn b, KRBErr\n\t}\n\treturn b, nil\n}\n\n// TGStoHashcat converts a TGS to a hashcat format.\nfunc TGStoHashcat(tgs messages.Ticket, username string) (string, error) {","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L178-L214","documentation":"The 4-byte size header was read and declared a body length, but io.ReadFull could not read that many bytes. Either the connection dropped mid-response, or the header was corrupt and declared far more data than the KDC will ever send, so the reader waits until the deadline and fails.","triggerScenarios":"Connection reset between header and body; a garbage size header (for example reading plaintext or an error banner as if it were Kerberos) yielding a huge length; deadline too short for a large ticket reply.","commonSituations":"Proxies injecting error pages into the stream; DCs truncating large TGS replies; slow links where big responses exceed the 5s deadline.","solutions":["Raise the client timeout above the 5s default so large replies fit in the window","Verify nothing in the path (proxy, TLS-terminating LB) rewrites or truncates raw TCP/88 traffic","Cross-check with UDP; a consistent failure on both transports points to message encoding rather than the network"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const resp = kerberos.SendToKDC(client, msg);\n} catch (e) {\n  // body read failed or declared length was bogus: raise the timeout and ensure nothing rewrites raw TCP/88 traffic\n}","preventionTips":["Keep proxies and TLS terminators out of the raw KDC path","Raise the timeout so large ticket replies fit inside the deadline"],"tags":["kerberos","tcp","protocol","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}