{"record":{"id":"b8f584605060326d","repo":"golang/go","slug":"tls-nextprotos-values-too-large","errorCode":null,"errorMessage":"tls: NextProtos values too large","messagePattern":"tls: NextProtos values too large","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client.go","lineNumber":59,"sourceCode":"\tticket       []byte        // a fresh ticket received during this handshake\n}\n\nfunc (c *Conn) makeClientHello() (*clientHelloMsg, *keySharePrivateKeys, *echClientContext, error) {\n\tconfig := c.config\n\tif len(config.ServerName) == 0 && !config.InsecureSkipVerify {\n\t\treturn nil, nil, nil, errors.New(\"tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config\")\n\t}\n\n\tnextProtosLength := 0\n\tfor _, proto := range config.NextProtos {\n\t\tif l := len(proto); l == 0 || l > 255 {\n\t\t\treturn nil, nil, nil, errors.New(\"tls: invalid NextProtos value\")\n\t\t} else {\n\t\t\tnextProtosLength += 1 + l\n\t\t}\n\t}\n\tif nextProtosLength > 0xffff {\n\t\treturn nil, nil, nil, errors.New(\"tls: NextProtos values too large\")\n\t}\n\n\tsupportedVersions := config.supportedVersions(roleClient, c.quic != nil)\n\tif len(supportedVersions) == 0 {\n\t\treturn nil, nil, nil, errors.New(\"tls: no supported versions satisfy MinVersion and MaxVersion\")\n\t}\n\t// Since supportedVersions is sorted in descending order, the first element\n\t// is the maximum version and the last element is the minimum version.\n\tmaxVersion := supportedVersions[0]\n\tminVersion := supportedVersions[len(supportedVersions)-1]\n\n\thello := &clientHelloMsg{\n\t\tvers:                         maxVersion,\n\t\tcompressionMethods:           []uint8{compressionNone},\n\t\trandom:                       make([]byte, 32),\n\t\textendedMasterSecret:         true,\n\t\tocspStapling:                 true,\n\t\tscts:                         true,","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client.go#L41-L77","documentation":"Thrown by makeClientHello when the total serialized size of all config.NextProtos entries (including 1-byte length prefix per entry) exceeds 65535 bytes (0xFFFF). The ALPN extension encodes the protocol list with a uint16 overall length prefix, capping the total at 64KB. This is unlikely with normal usage but possible with many or very large protocol IDs.","triggerScenarios":"Setting config.NextProtos to a slice where the sum of (1 + len(proto)) for all entries exceeds 0xFFFF (65535).","commonSituations":"Accidentally duplicating entries many times in a loop. Including extremely long protocol ID strings. A programming error that appends a large data structure as protocol names. Generating NextProtos from unbounded external input without size limits.","solutions":["Reduce the number of entries or the length of individual entries in config.NextProtos","Remove unnecessary or duplicate ALPN protocol IDs — typically only 2-3 are needed (e.g., \"h2\", \"http/1.1\")","Validate total size before assignment: ensure sum of (1 + len(proto)) for all entries is at most 65535","Cap external input that feeds into NextProtos to a reasonable maximum"],"exampleFix":"// before — overly large protocol list\nconfig := &tls.Config{\n    NextProtos: generateLargeProtocolList(), // total > 64KB\n}\n// after — trim to essential protocols\nconfig := &tls.Config{\n    NextProtos: []string{\"h2\", \"http/1.1\"},\n}","handlingStrategy":"validation","validationCode":"func validateNextProtosSize(protos []string) error {\n    total := 0\n    for _, p := range protos {\n        total += 1 + len(p)\n    }\n    if total > 0xffff {\n        return fmt.Errorf(\"total NextProtos size %d exceeds 65535 bytes\", total)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-validate total size:\n//\n//   if err := validateNextProtosSize(config.NextProtos); err != nil {\n//       config.NextProtos = config.NextProtos[:2] // trim to essential protocols\n//   }","preventionTips":["Keep NextProtos to a small set of standard ALPN IDs (typically 2-3 entries)","Avoid programmatically generating large protocol lists","Cap external input feeding into NextProtos"],"tags":["tls","client-side","config","alpn"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}