{"id":"6ef5c4aeff5f48ab","repo":"jackc/pgx","slug":"authentication-message-too-short","errorCode":null,"errorMessage":"authentication message too short","messagePattern":"authentication message too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_gss.go","lineNumber":19,"sourceCode":"package pgproto3\n\nimport (\n\t\"encoding/binary\"\n\t\"encoding/json\"\n\t\"errors\"\n\n\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\ntype AuthenticationGSS struct{}\n\nfunc (a *AuthenticationGSS) Backend() {}\n\nfunc (a *AuthenticationGSS) AuthenticationResponse() {}\n\nfunc (a *AuthenticationGSS) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeGSS {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\treturn nil\n}\n\nfunc (a *AuthenticationGSS) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeGSS)\n\treturn finishMessage(dst, sp)\n}\n\nfunc (a *AuthenticationGSS) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_gss.go#L1-L37","documentation":"Returned by AuthenticationGSS.Decode in pgproto3/authentication_gss.go:19 when the 'R' message body is shorter than 4 bytes - too small to even contain the auth-type code (AuthTypeGSS = 7). GSS is a variable-length message but still requires the leading uint32. It indicates a truncated/corrupted frame or Decode called on partial bytes.","triggerScenarios":"Server or proxy sends a truncated GSS Authentication frame (< 4-byte body); TCP stream cut mid-message; non-PostgreSQL responder; direct Decode on undersized input in a custom GSS proxy.","commonSituations":"GSS/SSPI/Kerberos negotiation against a misbehaving intermediary; connecting through a tunnel that fragments or truncates the startup exchange; fuzz testing pgproto3.","solutions":["Confirm the server really requests GSS auth and is a real PostgreSQL instance.","Remove or reconfigure intermediaries (proxy/SSH tunnel) that may truncate the handshake.","In direct pgproto3 use, require len(body) >= 4 before invoking Decode."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := pgconn.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication message too short\") {\n        return fmt.Errorf(\"truncated GSS auth frame from %s: %w\", connString, err)\n    }\n    return err\n}","preventionTips":["Confirm the server genuinely negotiates GSS/Kerberos and is real PostgreSQL.","Keep the TCP connection intact through the GSS startup; avoid truncating tunnels/proxies.","In direct pgproto3 use, require len(body) >= 4 before AuthenticationGSS.Decode."],"tags":["authentication","protocol","gss","kerberos","pgproto3"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}