jackc/pgx · error

gss encoding request too short

Error message

gss encoding request too short

What it means

Returned by GSSEncRequest.Decode when the supplied byte slice is shorter than 4 bytes. The first 4 bytes carry the GSS-encryption request magic number (80877104), so fewer than 4 bytes cannot be read. The library refuses to read past the buffer end rather than returning garbage.

Source

Thrown at pgproto3/gss_enc_request.go:20

import (
	"encoding/binary"
	"encoding/json"
	"errors"

	"github.com/jackc/pgx/v5/internal/pgio"
)

const gssEncReqNumber = 80877104

type GSSEncRequest struct{}

// Frontend identifies this message as sendable by a PostgreSQL frontend.
func (*GSSEncRequest) Frontend() {}

func (dst *GSSEncRequest) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("gss encoding request too short")
	}

	requestCode := binary.BigEndian.Uint32(src)

	if requestCode != gssEncReqNumber {
		return errors.New("bad gss encoding request code")
	}

	return nil
}

// Encode encodes src into dst. dst will include the 4 byte message length.
func (src *GSSEncRequest) Encode(dst []byte) ([]byte, error) {
	dst = pgio.AppendInt32(dst, 8)
	dst = pgio.AppendInt32(dst, gssEncReqNumber)
	return dst, nil
}

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Ensure the framing layer reads the complete 8-byte GSS request (4-byte length + 4-byte code) before invoking Decode; the body passed to Decode must be at least 4 bytes.
2. If reading manually, loop until at least 4 bytes are buffered before decoding.
3. Confirm the sender is actually emitting a GSS-encryption request (magic 80877104), not an SSL request or startup packet.
4. Log the actual length to distinguish a partial read from a misrouted message.

Example fix

// before
var gss pgproto3.GSSEncRequest
err := gss.Decode(buf) // buf is a partial 2-byte read

// after
if len(buf) < 4 {
    return fmt.Errorf("need >=4 bytes to decode GSS request, got %d", len(buf))
}
var gss pgproto3.GSSEncRequest
err := gss.Decode(buf)

func validateGSSEncRequestBody(src []byte) error {
	if len(src) < 4 {
		return fmt.Errorf("gss request body too short: %d bytes (need >=4)", len(src))
	}
	return nil
}

null

null

When it happens

Trigger: `(*GSSEncRequest).Decode(src)` is called with `len(src) < 4`. Occurs on the receiving side of a GSS request (a server, proxy, or test harness) when the framed body is truncated.

Common situations: A server or proxy receives a short first read and hands the partial buffer to Decode before the full 4 bytes arrive. Also seen in fuzzers or when a non-GSS packet is routed to the GSS decoder.

Related errors

• cancel request too short
• cancel request too long
• bad gss encoding request code
• bad auth type
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/69af345d4ea44d60.json. Report an issue: GitHub.