{"record":{"id":"e87028e83701ae05","repo":"projectdiscovery/nuclei","slug":"mysql-error-packet-too-short","errorCode":null,"errorMessage":"mysql error packet too short","messagePattern":"mysql error packet too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/mysql/fingerprint.go","lineNumber":177,"sourceCode":"\tout = append(out, header...)\n\tout = append(out, payload...)\n\treturn out, nil\n}\n\nfunc parseMySQLGreeting(packet []byte) (HandshakeInfo, error) {\n\tif len(packet) < 5 {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql packet too short\")\n\t}\n\tif packet[4] == mysqlErrorHeader {\n\t\treturn parseMySQLErrorPacket(packet)\n\t}\n\treturn parseMySQLHandshakePacket(packet)\n}\n\nfunc parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {\n\t// Stay compatible with fingerprintx error detection: minimum size and 0xff header.\n\tif len(packet) < 8 {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet too short\")\n\t}\n\tlength := mysqlPacketLength(packet)\n\tif length < 3 || length+4 > len(packet) {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet truncated\")\n\t}\n\tif packet[4] != mysqlErrorHeader {\n\t\treturn HandshakeInfo{}, fmt.Errorf(\"mysql error packet has invalid header\")\n\t}\n\n\tinfo := HandshakeInfo{\n\t\tPacketType: \"error\",\n\t\tErrorCode:  int(binary.LittleEndian.Uint16(packet[5:7])),\n\t}\n\tmsgStart := 7\n\t// Protocol 4.1 error packets may include '#' + 5-byte SQLSTATE.\n\tif 4+length > 8 && packet[7] == '#' && 4+length >= 13 {\n\t\tmsgStart = 13\n\t}","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/mysql/fingerprint.go#L159-L195","documentation":"When the first payload byte is 0xff the packet is an ERR packet, and parsing requires at least 8 bytes total: 4-byte header + 0xff + 2-byte error code + at least 1 byte of message. This error means an ERR-flagged packet arrived with fewer than 8 bytes, mirroring fingerprintx's minimum for error detection. It indicates a malformed or truncated error reply rather than a handshake.","triggerScenarios":"mysql.FingerprintMySQL against a server that immediately sends an ERR packet (e.g. 'host blocked', too many connections) but the packet is under 8 bytes — rare in practice; more commonly triggered by fixtures or a proxy mangling the reply.","commonSituations":"Servers rejecting the connection at greeting stage; middleware that truncates error payloads; hand-crafted test packets with 0xff but no error code.","solutions":["Inspect the raw first bytes (nc host 3306 | xxd) to see the actual packet","If the server is MySQL but erroring at greet (max_connections, host ban), fix that server-side condition and retry","Fall back to version detection via other probes (e.g. mysql_connect with credentials, banner, ssl)","In tests, pad ERR fixtures to >= 8 bytes with header + 0xff + code + message"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { const info = mysql.FingerprintMySQL(host, port); }\ncatch (e) { if (String(e).includes('mysql error packet too short')) log('malformed ERR greeting from ' + host); else throw e; }","preventionTips":["Pad ERR-packet fixtures in tests to >= 8 bytes","If a server greets with ERR, resolve the server-side cause (host ban, max_connections) and retry"],"tags":["mysql","protocol-parsing","fingerprint","error-packet","truncated-response","go"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}