{"record":{"id":"d1db526910d4654b","repo":"jstedfast/MailKit","slug":"challengetoolong","errorCode":"ChallengeTooLong","errorMessage":"Server challenge too long.","messagePattern":"Server challenge too long\\.","errorType":"error_code","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanismDigestMd5.cs","lineNumber":148,"sourceCode":"\t\t/// </exception>\n\t\t/// <exception cref=\"SaslException\">\n\t\t/// An error has occurred while parsing the server's challenge token.\n\t\t/// </exception>\n\t\tprotected override byte[]? Challenge (byte[]? token, int startIndex, int length, CancellationToken cancellationToken)\n\t\t{\n\t\t\tif (IsAuthenticated)\n\t\t\t\treturn null;\n\n\t\t\tif (Uri is null)\n\t\t\t\tthrow new InvalidOperationException ();\n\n\t\t\tswitch (state) {\n\t\t\tcase LoginState.Auth:\n\t\t\t\tif (token == null)\n\t\t\t\t\tthrow new NotSupportedException (\"DIGEST-MD5 does not support SASL-IR.\");\n\n\t\t\t\tif (token.Length > 2048)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.ChallengeTooLong, \"Server challenge too long.\");\n\n\t\t\t\tchallenge = DigestChallenge.Parse (Encoding.UTF8.GetString (token, startIndex, length));\n\t\t\t\tencoding = challenge.Charset != null ? Encoding.UTF8 : TextEncodings.Latin1;\n\t\t\t\tcnonce ??= GenerateEntropy (15);\n\n\t\t\t\tresponse = new DigestResponse (challenge, encoding, Uri.Scheme, Uri.DnsSafeHost, AuthorizationId, Credentials.UserName, Credentials.Password, cnonce);\n\t\t\t\tstate = LoginState.Final;\n\n\t\t\t\treturn response.Encode (encoding);\n\t\t\tcase LoginState.Final:\n\t\t\t\tif (token == null || token.Length == 0)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.MissingChallenge, \"Server response did not contain any authentication data.\");\n\n\t\t\t\tvar text = encoding!.GetString (token, startIndex, length);\n\t\t\t\tstring? key, value;\n\n\t\t\t\tif (!DigestChallenge.TryParseKeyValuePair (text, out key, out value))\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.IncompleteChallenge, \"Server response contained incomplete authentication data.\");","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanismDigestMd5.cs#L130-L166","documentation":"RFC 2831 caps the DIGEST-MD5 challenge at 2048 bytes. SaslMechanismDigestMd5.Challenge throws SaslException with code SaslErrorCode.ChallengeTooLong when the server's initial challenge exceeds this limit, protecting against malformed or hostile servers.","triggerScenarios":"Server sends a DIGEST-MD5 challenge whose encoded length is greater than 2048 bytes during the Auth state of the exchange.","commonSituations":"Misbehaving or non-conformant/proprietary servers that append extra data to the challenge, proxies injecting banners into the SASL exchange, garbage bytes on the socket being misinterpreted as a challenge.","solutions":["Fix or report the server so it emits a compliant (<2048 bytes) DIGEST-MD5 challenge.","Inspect the raw server response (network trace) to find what is inflating the challenge (banners, proxy injection) and remove the source.","Catch SaslException, check ErrorCode == SaslErrorCode.ChallengeTooLong, and fall back to another mechanism (e.g. CRAM-MD5, PLAIN over TLS)."],"exampleFix":"// before\nclient.Authenticate(uri, new SaslMechanismDigestMd5(uri, user, pass)); // server challenge > 2048 bytes\n// after\ntry {\n    client.Authenticate(uri, new SaslMechanismDigestMd5(uri, user, pass));\n} catch (SaslException ex) when (ex.ErrorCode == SaslErrorCode.ChallengeTooLong) {\n    client.Authenticate(uri, new SaslMechanismCramMd5(user, pass));\n}","handlingStrategy":"try-catch","validationCode":"// client-side cannot validate before receipt; guard the exchange instead\n// ensure no proxy/banner injection inflates the server's challenge","typeGuard":null,"tryCatchPattern":"try {\n    client.Authenticate(uri, new SaslMechanismDigestMd5(uri, user, pass));\n} catch (SaslException ex) when (ex.ErrorCode == SaslErrorCode.ChallengeTooLong) {\n    // non-conformant server; fall back\n    client.Authenticate(uri, new SaslMechanismCramMd5(user, pass));\n}","preventionTips":["Check ErrorCode on SaslException to distinguish server bugs from credential failures","Inspect raw server challenges with a trace when challenges exceed 2048 bytes","Report non-conformant servers; prefer standards-compliant mechanisms (SCRAM)"],"tags":["sasl","digest-md5","protocol-limit","server-error"],"backgroundTag":"value-out-of-range","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}