{"record":{"id":"aea3caba47342d96","repo":"caddyserver/caddy","slug":"port-range-exceeds-d-ports","errorCode":null,"errorMessage":"port range exceeds %d ports","messagePattern":"port range exceeds (.+?) ports","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"listeners.go","lineNumber":365,"sourceCode":"\t\tend = uint64(defaultPort)\n\t} else {\n\t\tbefore, after, found := strings.Cut(port, \"-\")\n\t\tif !found {\n\t\t\tafter = before\n\t\t}\n\t\tstart, err = strconv.ParseUint(before, 10, 16)\n\t\tif err != nil {\n\t\t\treturn NetworkAddress{}, fmt.Errorf(\"invalid start port: %v\", err)\n\t\t}\n\t\tend, err = strconv.ParseUint(after, 10, 16)\n\t\tif err != nil {\n\t\t\treturn NetworkAddress{}, fmt.Errorf(\"invalid end port: %v\", err)\n\t\t}\n\t\tif end < start {\n\t\t\treturn NetworkAddress{}, fmt.Errorf(\"end port must not be less than start port\")\n\t\t}\n\t\tif (end - start) > maxPortSpan {\n\t\t\treturn NetworkAddress{}, fmt.Errorf(\"port range exceeds %d ports\", maxPortSpan)\n\t\t}\n\t}\n\treturn NetworkAddress{\n\t\tNetwork:   network,\n\t\tHost:      host,\n\t\tStartPort: uint(start),\n\t\tEndPort:   uint(end),\n\t}, nil\n}\n\n// SplitNetworkAddress splits a into its network, host, and port components.\n// Note that port may be a port range (:X-Y), or omitted for unix sockets.\nfunc SplitNetworkAddress(a string) (network, host, port string, err error) {\n\tbeforeSlash, afterSlash, slashFound := strings.Cut(a, \"/\")\n\tif slashFound {\n\t\tnetwork = strings.ToLower(strings.TrimSpace(beforeSlash))\n\t\ta = afterSlash\n\t\tif IsUnixNetwork(network) || IsFdNetwork(network) {","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/listeners.go#L347-L383","documentation":"Caddy caps port ranges at maxPortSpan ports to prevent a single address from opening an unmanageable number of listeners. If (end - start) exceeds the cap, parsing fails with the limit in the message.","triggerScenarios":"Wide ranges such as ':1-65535' or ':1000-99999' (already caught by uint16, but ':1-65535' passes numeric checks) where the span exceeds maxPortSpan.","commonSituations":"Users trying to bind all ports or emulate a wildcard listener; misreading a CIDR-style '0-65535' shorthand; copy-paste from firewall rule syntax.","solutions":["Narrow the range to only the ports actually served (e.g. ':8080-8085').","Bind the specific ports you need as separate listen directives instead of one giant range.","Remember a port is not a wildcard: listening on all 65535 ports is neither supported nor advisable."],"exampleFix":"// before\n{\n  listen :1-65535\n}\n// after\n{\n  listen :80\n  listen :443\n}","handlingStrategy":"validation","validationCode":"const maxPortSpan = 64 // mirror caddy's cap\n\nfunc spanOK(start, end uint64) bool { return end-start <= maxPortSpan }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never generate ranges wider than a few dozen ports.","Replace 'listen on all ports' designs with explicit per-service ports."],"tags":["port","port-range","limits","validation"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}