{"record":{"id":"f3787571b67b30d0","repo":"golang/go","slug":"tls-client-does-not-support-uncompressed-connecti","errorCode":null,"errorMessage":"tls: client does not support uncompressed connections","messagePattern":"tls: client does not support uncompressed connections","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server.go","lineNumber":232,"sourceCode":"\nfunc (hs *serverHandshakeState) processClientHello() error {\n\tc := hs.c\n\n\ths.hello = new(serverHelloMsg)\n\ths.hello.vers = c.vers\n\n\tfoundCompression := false\n\t// We only support null compression, so check that the client offered it.\n\tfor _, compression := range hs.clientHello.compressionMethods {\n\t\tif compression == compressionNone {\n\t\t\tfoundCompression = true\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif !foundCompression {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: client does not support uncompressed connections\")\n\t}\n\n\ths.hello.random = make([]byte, 32)\n\tserverRandom := hs.hello.random\n\t// Downgrade protection canaries. See RFC 8446, Section 4.1.3.\n\tmaxVers := c.config.maxSupportedVersion(roleServer, c.quic != nil)\n\tif maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {\n\t\tif c.vers == VersionTLS12 {\n\t\t\tcopy(serverRandom[24:], downgradeCanaryTLS12)\n\t\t} else {\n\t\t\tcopy(serverRandom[24:], downgradeCanaryTLS11)\n\t\t}\n\t\tserverRandom = serverRandom[:24]\n\t}\n\t_, err := io.ReadFull(c.config.rand(), serverRandom)\n\tif err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server.go#L214-L250","documentation":"The client's ClientHello did not include the null (uncompressed) compression method. TLS 1.2 and below only support compressionNone (0); if the client omits it, no common compression can be selected and the server sends illegal_parameter.","triggerScenarios":"processClientHello iterates hs.clientHello.compressionMethods looking for compressionNone (0); none was found. The client offered only non-null compressions or sent an empty list.","commonSituations":"A buggy or malicious client omitting the mandatory null compression method (every conformant ClientHello must include 0). Also seen in fuzz tests, malformed handshakes from custom TLS stacks, or protocol-level scanners.","solutions":["Use a standards-compliant TLS client library — every ClientHello must list compression method 0 (null).","If you control the client, ensure the compression_methods vector contains at least [0x00].","If hitting this from a scanner or test harness, treat it as expected; the server is correctly rejecting a malformed hello.","Upgrade the client TLS implementation."],"exampleFix":"// Client-side: ensure the ClientHello always offers null compression.\n// Standard Go/Rust/OpenSSL clients do this automatically — no config needed.\n// If you built a custom ClientHello encoder, include 0x00:\ncompressionMethods: []byte{0x00}","handlingStrategy":"validation","validationCode":"// Client: ensure null compression is offered. Standard Go clients do this\n// automatically. For custom ClientHello encoders:\ncompressionMethods := []byte{0x00 /* null */}","typeGuard":null,"tryCatchPattern":"// Server: this is a malformed-client rejection — log and close.\nif err != nil && strings.Contains(err.Error(), \"does not support uncompressed connections\") {\n    log.Warn(\"malformed ClientHello\", \"remote\", conn.RemoteAddr())\n    conn.Close()\n}","preventionTips":["Always include compression method 0x00 in any custom ClientHello encoder.","Reject malformed hellos quickly at the server edge.","Use a vetted TLS library rather than rolling your own ClientHello."],"tags":["tls","server-handshake","compression","protocol-violation","tls12"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}