{"id":"05407baaf8d26eb2","repo":"jackc/pgx","slug":"scram-iteration-count-from-server-too-high-d-ma","errorCode":null,"errorMessage":"SCRAM iteration count from server too high: %d (max %d)","messagePattern":"SCRAM iteration count from server too high: (.+?) \\(max (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":292,"sourceCode":"\tbuf = buf[2:]\n\titerationsStr := buf\n\n\tvar err error\n\tsc.salt, err = base64.StdEncoding.DecodeString(string(saltStr))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid SCRAM salt received from server: %w\", err)\n\t}\n\n\tsc.iterations, err = strconv.Atoi(string(iterationsStr))\n\tif err != nil || sc.iterations <= 0 {\n\t\treturn fmt.Errorf(\"invalid SCRAM iteration count received from server: %w\", err)\n\t}\n\t// Bound server-supplied iteration count to prevent a malicious server from forcing the client\n\t// to spend unbounded CPU in PBKDF2. PostgreSQL's scram_iterations defaults to 4096; this ceiling\n\t// is ~2500x that.\n\tconst maxScramIterations = 10_000_000\n\tif sc.iterations > maxScramIterations {\n\t\treturn fmt.Errorf(\"SCRAM iteration count from server too high: %d (max %d)\", sc.iterations, maxScramIterations)\n\t}\n\n\tif !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not start with client nonce\")\n\t}\n\n\tif len(sc.clientAndServerNonce) <= len(sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not include server nonce\")\n\t}\n\n\treturn nil\n}\n\nfunc (sc *scramClient) clientFinalMessage() string {\n\t// The c= attribute carries the base64-encoded channel binding input.\n\t//\n\t// Without channel binding this is just the GS2 header alone (\"biws\" for\n\t// \"n,,\" or \"eSws\" for \"y,,\").","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L274-L310","documentation":"Error \"SCRAM iteration count from server too high: %d (max %d)\" thrown in jackc/pgx.","triggerScenarios":"Thrown at pgconn/auth_scram.go:292 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}