projectdiscovery/nuclei · warning

mysql error packet too short

Error message

mysql error packet too short

What it means

When the first payload byte is 0xff the packet is an ERR packet, and parsing requires at least 8 bytes total: 4-byte header + 0xff + 2-byte error code + at least 1 byte of message. This error means an ERR-flagged packet arrived with fewer than 8 bytes, mirroring fingerprintx's minimum for error detection. It indicates a malformed or truncated error reply rather than a handshake.

Source

Thrown at pkg/js/libs/mysql/fingerprint.go:177

	out = append(out, header...)
	out = append(out, payload...)
	return out, nil
}

func parseMySQLGreeting(packet []byte) (HandshakeInfo, error) {
	if len(packet) < 5 {
		return HandshakeInfo{}, fmt.Errorf("mysql packet too short")
	}
	if packet[4] == mysqlErrorHeader {
		return parseMySQLErrorPacket(packet)
	}
	return parseMySQLHandshakePacket(packet)
}

func parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {
	// Stay compatible with fingerprintx error detection: minimum size and 0xff header.
	if len(packet) < 8 {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet too short")
	}
	length := mysqlPacketLength(packet)
	if length < 3 || length+4 > len(packet) {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet truncated")
	}
	if packet[4] != mysqlErrorHeader {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet has invalid header")
	}

	info := HandshakeInfo{
		PacketType: "error",
		ErrorCode:  int(binary.LittleEndian.Uint16(packet[5:7])),
	}
	msgStart := 7
	// Protocol 4.1 error packets may include '#' + 5-byte SQLSTATE.
	if 4+length > 8 && packet[7] == '#' && 4+length >= 13 {
		msgStart = 13
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Inspect the raw first bytes (nc host 3306 | xxd) to see the actual packet
2. If the server is MySQL but erroring at greet (max_connections, host ban), fix that server-side condition and retry
3. Fall back to version detection via other probes (e.g. mysql_connect with credentials, banner, ssl)
4. In tests, pad ERR fixtures to >= 8 bytes with header + 0xff + code + message

try { const info = mysql.FingerprintMySQL(host, port); }
catch (e) { if (String(e).includes('mysql error packet too short')) log('malformed ERR greeting from ' + host); else throw e; }

When it happens

Trigger: mysql.FingerprintMySQL against a server that immediately sends an ERR packet (e.g. 'host blocked', too many connections) but the packet is under 8 bytes — rare in practice; more commonly triggered by fixtures or a proxy mangling the reply.

Common situations: Servers rejecting the connection at greeting stage; middleware that truncates error payloads; hand-crafted test packets with 0xff but no error code.

Related errors

• mysql packet too short
• mysql error packet truncated
• mysql handshake packet too short
• empty mysql greeting
• invalid mysql packet length %d

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/e87028e83701ae05. Report an issue: GitHub.