jackc/pgx · error

authentication message too short

Error message

authentication message too short

What it means

Returned by AuthenticationGSSContinue.Decode in pgproto3/authentication_gss_continue.go:21 when the body is < 4 bytes. GSSContinue carries the 4-byte auth code (AuthTypeGSSCont = 8) followed by a variable GSS data payload, so anything shorter than 4 bytes cannot even be type-checked. Indicates truncation/corruption or Decode on partial bytes.

Source

Thrown at pgproto3/authentication_gss_continue.go:21

import (
	"encoding/binary"
	"encoding/json"
	"errors"

	"github.com/jackc/pgx/v5/internal/pgio"
)

type AuthenticationGSSContinue struct {
	Data []byte
}

func (a *AuthenticationGSSContinue) Backend() {}

func (a *AuthenticationGSSContinue) AuthenticationResponse() {}

func (a *AuthenticationGSSContinue) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeGSSCont {
		return errors.New("bad auth type")
	}

	a.Data = src[4:]
	return nil
}

func (a *AuthenticationGSSContinue) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeGSSCont)
	dst = append(dst, a.Data...)
	return finishMessage(dst, sp)
}

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Ensure the connection stays open for the full multi-step GSS exchange.
2. Remove intermediaries that truncate large GSS continuation tokens.
3. Validate len(body) >= 4 before decoding in custom code.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "authentication message too short") {
        return fmt.Errorf("truncated GSS continue frame from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: A GSS continue frame arrives truncated during the multi-round-trip Kerberos exchange; connection dropped mid-handshake; proxy truncates the frame; direct Decode on undersized input.

Common situations: GSS/Kerberos auth over an unstable link or through a truncating proxy; large GSS tokens split incorrectly; fuzz input.

Related errors

• authentication message too short
• bad auth type
• bad auth type
• bad gss encoding request code
• bad authentication message size

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/eb1808c59654ab07.json. Report an issue: GitHub.