projectdiscovery/nuclei · warning

mysql error packet truncated

Error message

mysql error packet truncated

What it means

For an ERR packet, the declared 3-byte payload length must be at least 3 (0xff + 2-byte error code) and the header plus payload must fit inside the received bytes (length+4 <= len(packet)). This error means the length field says the error payload is smaller than the minimum or larger than what actually arrived — a self-inconsistent packet. It keeps nuclei compatible with fingerprintx's error-packet validation.

Source

Thrown at pkg/js/libs/mysql/fingerprint.go:181

func parseMySQLGreeting(packet []byte) (HandshakeInfo, error) {
	if len(packet) < 5 {
		return HandshakeInfo{}, fmt.Errorf("mysql packet too short")
	}
	if packet[4] == mysqlErrorHeader {
		return parseMySQLErrorPacket(packet)
	}
	return parseMySQLHandshakePacket(packet)
}

func parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {
	// Stay compatible with fingerprintx error detection: minimum size and 0xff header.
	if len(packet) < 8 {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet too short")
	}
	length := mysqlPacketLength(packet)
	if length < 3 || length+4 > len(packet) {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet truncated")
	}
	if packet[4] != mysqlErrorHeader {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet has invalid header")
	}

	info := HandshakeInfo{
		PacketType: "error",
		ErrorCode:  int(binary.LittleEndian.Uint16(packet[5:7])),
	}
	msgStart := 7
	// Protocol 4.1 error packets may include '#' + 5-byte SQLSTATE.
	if 4+length > 8 && packet[7] == '#' && 4+length >= 13 {
		msgStart = 13
	}
	if msgStart < 4+length {
		info.ErrorMessage = readPrintableASCII(packet[msgStart : 4+length])
	}
	return info, nil

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Capture the full exchange (tcpdump -i any port 3306 -w out.pcap) and compare the declared length with actual bytes
2. Rule out middleboxes by connecting directly to the DB host
3. Treat as a failed fingerprint and fall back to generic service detection
4. In fixtures, keep the 3-byte length consistent with the payload you appended

try { const info = mysql.FingerprintMySQL(host, port); }
catch (e) { if (String(e).includes('mysql error packet truncated')) log('inconsistent ERR packet from ' + host); else throw e; }

When it happens

Trigger: mysql.FingerprintMySQL against a peer whose ERR packet declares a payload < 3 bytes or claims more bytes than were delivered — truncated TCP reads, proxies rewriting lengths, or malformed emulators.

Common situations: Connections cut mid-packet by firewalls; test fixtures with mismatched length fields; protocol fuzzing corpora.

Related errors

• invalid mysql packet length %d
• mysql packet too short
• mysql error packet too short
• mysql handshake packet too short
• mysql handshake packet length out of range

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/84194616bf64772f. Report an issue: GitHub.