jackc/pgx · error

authentication message too short

Error message

authentication message too short

What it means

Returned by AuthenticationGSS.Decode in pgproto3/authentication_gss.go:19 when the 'R' message body is shorter than 4 bytes - too small to even contain the auth-type code (AuthTypeGSS = 7). GSS is a variable-length message but still requires the leading uint32. It indicates a truncated/corrupted frame or Decode called on partial bytes.

Source

Thrown at pgproto3/authentication_gss.go:19

package pgproto3

import (
	"encoding/binary"
	"encoding/json"
	"errors"

	"github.com/jackc/pgx/v5/internal/pgio"
)

type AuthenticationGSS struct{}

func (a *AuthenticationGSS) Backend() {}

func (a *AuthenticationGSS) AuthenticationResponse() {}

func (a *AuthenticationGSS) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeGSS {
		return errors.New("bad auth type")
	}
	return nil
}

func (a *AuthenticationGSS) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeGSS)
	return finishMessage(dst, sp)
}

func (a *AuthenticationGSS) MarshalJSON() ([]byte, error) {
	return json.Marshal(struct {

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Confirm the server really requests GSS auth and is a real PostgreSQL instance.
2. Remove or reconfigure intermediaries (proxy/SSH tunnel) that may truncate the handshake.
3. In direct pgproto3 use, require len(body) >= 4 before invoking Decode.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "authentication message too short") {
        return fmt.Errorf("truncated GSS auth frame from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: Server or proxy sends a truncated GSS Authentication frame (< 4-byte body); TCP stream cut mid-message; non-PostgreSQL responder; direct Decode on undersized input in a custom GSS proxy.

Common situations: GSS/SSPI/Kerberos negotiation against a misbehaving intermediary; connecting through a tunnel that fragments or truncates the startup exchange; fuzz testing pgproto3.

Related errors

• bad auth type
• authentication message too short
• bad auth type
• bad gss encoding request code
• bad authentication message size

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/6ef5c4aeff5f48ab.json. Report an issue: GitHub.