projectdiscovery/nuclei · info

mysql error packet has invalid header

Error message

mysql error packet has invalid header

What it means

After routing on packet[4] == 0xff, parseMySQLErrorPacket re-validates that header byte as an internal invariant. Because the only caller (parseMySQLGreeting) enters this function precisely when packet[4] is 0xff, this branch is unreachable defensive code guarding against future callers passing non-error packets. Encountering it implies the parser was invoked directly with a handshake packet.

Source

Thrown at pkg/js/libs/mysql/fingerprint.go:184

		return HandshakeInfo{}, fmt.Errorf("mysql packet too short")
	}
	if packet[4] == mysqlErrorHeader {
		return parseMySQLErrorPacket(packet)
	}
	return parseMySQLHandshakePacket(packet)
}

func parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {
	// Stay compatible with fingerprintx error detection: minimum size and 0xff header.
	if len(packet) < 8 {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet too short")
	}
	length := mysqlPacketLength(packet)
	if length < 3 || length+4 > len(packet) {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet truncated")
	}
	if packet[4] != mysqlErrorHeader {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet has invalid header")
	}

	info := HandshakeInfo{
		PacketType: "error",
		ErrorCode:  int(binary.LittleEndian.Uint16(packet[5:7])),
	}
	msgStart := 7
	// Protocol 4.1 error packets may include '#' + 5-byte SQLSTATE.
	if 4+length > 8 && packet[7] == '#' && 4+length >= 13 {
		msgStart = 13
	}
	if msgStart < 4+length {
		info.ErrorMessage = readPrintableASCII(packet[msgStart : 4+length])
	}
	return info, nil
}

func parseMySQLHandshakePacket(packet []byte) (HandshakeInfo, error) {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. If writing Go tests, only feed packets whose byte 4 is 0xff to this function
2. Route through parseMySQLGreeting so the 0xff dispatch happens automatically
3. No action needed on the live path — prefer the public FingerprintMySQL API

// Go: only route error packets to the error parser
func isErrorPacket(p []byte) bool { return len(p) >= 5 && p[4] == 0xff }

When it happens

Trigger: Go code or tests calling parseMySQLErrorPacket directly with a packet whose 5th byte is not 0xff; not reachable through the public mysql.FingerprintMySQL flow.

Common situations: Unit tests exercising the error-packet parser in isolation; refactors that reroute packets to the wrong parse function.

Related errors

• empty mysql greeting
• invalid mysql packet length %d
• mysql packet too short
• mysql error packet too short
• mysql error packet truncated

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/181187d583a3d2d7. Report an issue: GitHub.