What causes "error reading response size header: %v" in projectdiscovery/nuclei?

Validate the Kerberos message encoding before sending (a KDC that drops garbage usually closes the connection)

error reading response size header: %v

Error message

error reading response size header: %v

What it means

After a successful send, sendTCP reads the 4-byte big-endian response size header mandated by RFC 4120 7.2.2, and that read failed. Causes: the KDC closed or reset the connection without answering, or the read deadline (config.timeout seconds, 5 by default) expired before any byte arrived.

Source

Thrown at pkg/js/libs/kerberos/sendtokdc.go:189

func sendTCP(conn *net.TCPConn, b []byte) ([]byte, error) {
	defer func() {
		_ = conn.Close()
	}()
	var r []byte
	// RFC 4120 7.2.2 specifies the first 4 bytes indicate the length of the message in big endian order.
	hb := make([]byte, 4)
	binary.BigEndian.PutUint32(hb, uint32(len(b)))
	b = append(hb, b...)

	_, err := conn.Write(b)
	if err != nil {
		return r, fmt.Errorf("error sending to KDC (%s): %v", conn.RemoteAddr().String(), err)
	}

	sh := make([]byte, 4)
	_, err = conn.Read(sh)
	if err != nil {
		return r, fmt.Errorf("error reading response size header: %v", err)
	}
	s := binary.BigEndian.Uint32(sh)

	rb := make([]byte, s)
	_, err = io.ReadFull(conn, rb)
	if err != nil {
		return r, fmt.Errorf("error reading response: %v", err)
	}
	if len(rb) < 1 {
		return r, fmt.Errorf("no response data from KDC %s", conn.RemoteAddr().String())
	}
	return rb, nil
}

// CheckKrbError checks if the response bytes from the KDC are a KRBError.
func CheckKrbError(b []byte) ([]byte, error) {
	var KRBErr messages.KRBError
	if err := KRBErr.Unmarshal(b); err == nil {

View on GitHub (pinned to 265b3a3dec)

Solutions

Validate the Kerberos message encoding before sending (a KDC that drops garbage usually closes the connection)
Raise the client timeout above the 5s default
Try the UDP transport for the same message as a cross-check

Defensive patterns

Strategy: retry

Try / catch

try {
  const resp = kerberos.SendToKDC(client, msg);
} catch (e) {
  // KDC closed before sending the 4-byte size header: verify message encoding, raise the 5s timeout, or try UDP
}

Prevention

KDCs that silently close usually received a malformed request - lint the ASN.1 first
Raise the timeout when scanning loaded or remote DCs

When it happens

Trigger: KDC silently dropping malformed requests by closing the socket; firewall or IPS sending RST; DC under heavy load answering after the 5s deadline; connection kept half-open by a middlebox.

Common situations: Hand-crafted ASN.1 messages with encoding errors; scanning during DC backup windows; tight timeouts over WAN links to remote domains.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/bb54453ffe78bee2. Report an issue: GitHub.