{"record":{"id":"c667a46fc32fbc33","repo":"gorilla/websocket","slug":"websocket-read-limit-exceeded","errorCode":null,"errorMessage":"websocket: read limit exceeded","messagePattern":"websocket: read limit exceeded","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"conn.go","lineNumber":90,"sourceCode":"\t// function to format a close message payload.\n\tCloseMessage = 8\n\n\t// PingMessage denotes a ping control message. The optional message payload\n\t// is UTF-8 encoded text.\n\tPingMessage = 9\n\n\t// PongMessage denotes a pong control message. The optional message payload\n\t// is UTF-8 encoded text.\n\tPongMessage = 10\n)\n\n// ErrCloseSent is returned when the application writes a message to the\n// connection after sending a close message.\nvar ErrCloseSent = errors.New(\"websocket: close sent\")\n\n// ErrReadLimit is returned when reading a message that is larger than the\n// read limit set for the connection.\nvar ErrReadLimit = errors.New(\"websocket: read limit exceeded\")\n\n// netError satisfies the net Error interface.\ntype netError struct {\n\tmsg       string\n\ttemporary bool\n\ttimeout   bool\n}\n\nfunc (e *netError) Error() string   { return e.msg }\nfunc (e *netError) Temporary() bool { return e.temporary }\nfunc (e *netError) Timeout() bool   { return e.timeout }\n\n// CloseError represents a close message.\ntype CloseError struct {\n\t// Code is defined in RFC 6455, section 11.7.\n\tCode int\n\n\t// Text is the optional text payload.","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/gorilla/websocket/blob/e064f32e3674d9d79a8fd417b5bc06fa5c6cad8f/conn.go#L72-L108","documentation":"ErrReadLimit is returned when an incoming message exceeds the limit set by Conn.SetReadLimit. It surfaces from the read path (setReadRemaining) as soon as the remaining message size is known to exceed the limit. This protects the application from memory exhaustion via oversized frames/messages.","triggerScenarios":"Calling conn.ReadMessage/NextReader when the peer sends a message larger than the configured read limit (default limit is unlimited unless SetReadLimit is called; if set, exceeding it returns this error).","commonSituations":"Peer (or attacker) sending huge payloads; limit set too low for legitimate large messages (e.g. file uploads over a message); limit configured from a config value mismatched with production traffic sizes.","solutions":["Raise the limit via conn.SetReadLimit to accommodate legitimate message sizes","Send large payloads in chunks or out-of-band (HTTP upload + reference in the message)","On ErrReadLimit, close the connection with CloseMessageTooBig (1009) per spec","Validate message size expectations server-side and log offending clients"],"exampleFix":"// before\nconn.SetReadLimit(4096)\nmsg, _, err := conn.ReadMessage() // fails for big payloads\n// after\nconn.SetReadLimit(1 << 20) // 1 MiB\nmsg, _, err := conn.ReadMessage()\nif errors.Is(err, websocket.ErrReadLimit) {\n    conn.Close() // or send CloseMessageTooBig\n    return\n}","handlingStrategy":"type-guard","validationCode":"conn.SetReadLimit(maxAllowedBytes) // choose from known payload limits\nguard := func(n int) error { if n > maxAllowedBytes { return errors.New(\"payload too large\") }; return nil }","typeGuard":"func isReadLimit(err error) bool {\n    return errors.Is(err, websocket.ErrReadLimit)\n}","tryCatchPattern":"_, msg, err := conn.ReadMessage()\nif err != nil {\n    if errors.Is(err, websocket.ErrReadLimit) {\n        websocket.CloseMessage... // send close 1009 and drop the peer\n        conn.WriteControl(websocket.CloseMessage,\n            websocket.FormatCloseMessage(websocket.CloseMessageTooBig, \"too big\"),\n            time.Now().Add(time.Second))\n        return\n    }\n    return err\n}","preventionTips":["Set an explicit read limit on every connection to bound memory use","Match the limit to the largest legitimate message plus headroom","Chunk large payloads or move them out-of-band instead of raising limits indefinitely"],"tags":["websocket","read-limit","security"],"backgroundTag":"message-size-limit-exceeded","analyzedSha":"e064f32e3674d9d79a8fd417b5bc06fa5c6cad8f","analyzedAt":"2026-08-31T12:40:58.222Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}