gravitational/teleport · warning

distinguished name too large, refusing to parse

Error message

distinguished name too large, refusing to parse

What it means

ParseDistinguishedName rejects X.509 distinguished name strings longer than 4096 characters (maxDNLength, an arbitrary safety cap) before tokenizing. This guards the parser against pathological or maliciously oversized DN input that could exhaust resources or blow past downstream limits.

Source

Thrown at api/utils/pkixname/parser.go:58

//     2.5.4.10, etc.
//   - Hexstrings are not supported (ie, "#1234ABCD"). Custom OIDs values must
//     be strings.
//   - Attribute types may not be prefixed with "oid." or "OID.".
//   - Escaped characters are limited to specials and the space character (' ').
//     No other escapes are allowed, including hex escaping.
//   - Multi-valued RDNs are only allowed if all values refer to the same
//     attributeType.
//   - The only character interpreted as whitespace is the space character
//     (' ').
//
// Reference: https://www.rfc-editor.org/rfc/rfc2253.
func ParseDistinguishedName(dn string) (*pkix.Name, error) {
	const maxDNLength = 4096 // arbitrary-ish upper value
	switch {
	case dn == "": // Early exit.
		return &pkix.Name{}, nil
	case len(dn) > maxDNLength:
		return nil, errors.New("distinguished name too large, refusing to parse")
	}

	tokens, err := tokenize(dn)
	if err != nil {
		return nil, err
	}

	dst := &pkix.Name{}
	if tokens.Len() == 0 {
		return dst, nil
	}
	if err := parseRDNSequence(dst, *tokens); err != nil {
		return nil, fmt.Errorf("malformed RDNs: %w", err)
	}
	return dst, nil
}

// parseRDNSequence parses a RelativeDistinguishedName sequence, ie, a sequence

View on GitHub (pinned to 1283425b60)

Solutions

1. Shorten the DN: remove or abbreviate excessive attributes so it is under 4096 characters, then re-parse.
2. Trim/clean the input upstream (strip whitespace, duplicate RDNs, or joined DN strings) before calling ParseDistributedName.
3. If you legitimately need larger DNs, treat this as a hard limit and reject the certificate/config early with a clear validation message rather than bypassing the parser.

if len(dn) > 4096 { return fmt.Errorf("DN too long (%d > 4096)", len(dn)) }
if dn == "" { return pkix.Name{} }

When it happens

Trigger: Calling ParseDistinguishedName (directly or via callers like Run / anonymous wrappers parsing cert subjects) with a DN string whose length exceeds 4096 characters.

Common situations: Feeding certificates or config values with extremely long organizational attributes; fuzzing/attacker-supplied SAML or cert subjects; accidental concatenation of multiple DNs into one string.

Related errors

• malformed RDNs: %w
• repeated attributeType %q, remaining tokens: %s
• multi-valued RDN must refer to the same attribute, but found
• not enough tokens to parse AttributeTypeValue, remaining tok
• invalid attributeType (bad character set): %q

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/93440b988eed0c35. Report an issue: GitHub.