projectdiscovery/nuclei · warning

mysql packet too short

Error message

mysql packet too short

What it means

parseMySQLGreeting needs at least 5 bytes: the 4-byte header plus the payload's first byte, which distinguishes an error packet (0xff) from a handshake. This error means fewer than 5 bytes were supplied, so even the packet type cannot be read. On the live path recvMySQLPacket enforces length >= 1, so this fires from direct parser use (tests, fuzzing) or a future caller bypassing the read gate.

Source

Thrown at pkg/js/libs/mysql/fingerprint.go:166

		return nil, err
	}
	length := int(uint32(header[0]) | uint32(header[1])<<8 | uint32(header[2])<<16)
	if length <= 0 || length > 16*1024*1024 {
		return nil, fmt.Errorf("invalid mysql packet length %d", length)
	}
	payload := make([]byte, length)
	if _, err := io.ReadFull(conn, payload); err != nil {
		return nil, err
	}
	out := make([]byte, 0, 4+length)
	out = append(out, header...)
	out = append(out, payload...)
	return out, nil
}

func parseMySQLGreeting(packet []byte) (HandshakeInfo, error) {
	if len(packet) < 5 {
		return HandshakeInfo{}, fmt.Errorf("mysql packet too short")
	}
	if packet[4] == mysqlErrorHeader {
		return parseMySQLErrorPacket(packet)
	}
	return parseMySQLHandshakePacket(packet)
}

func parseMySQLErrorPacket(packet []byte) (HandshakeInfo, error) {
	// Stay compatible with fingerprintx error detection: minimum size and 0xff header.
	if len(packet) < 8 {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet too short")
	}
	length := mysqlPacketLength(packet)
	if length < 3 || length+4 > len(packet) {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet truncated")
	}
	if packet[4] != mysqlErrorHeader {
		return HandshakeInfo{}, fmt.Errorf("mysql error packet has invalid header")

View on GitHub (pinned to 265b3a3dec)

Solutions

1. On the live path, treat as 'connection closed early / not MySQL' and fall back to banner detection
2. In Go tests, ensure fixtures include the 4-byte header plus at least 1 payload byte
3. Capture the exchange with tcpdump to see exactly how many bytes the server sent
4. Retry once to rule out transient truncation before classifying the port as non-MySQL

try { const info = mysql.FingerprintMySQL(host, port); }
catch (e) { if (String(e).includes('mysql packet too short')) log('greeting truncated from ' + host); else throw e; }

When it happens

Trigger: Calling parseMySQLGreeting (or the JS FingerprintMySQL flow) with a buffer under 5 bytes — truncated captures fed into Go tests, fuzz corpora, or a connection that closed after delivering a partial header.

Common situations: Go unit tests with short fixtures; pcap-derived payloads that were cut; connections closed mid-read by aggressive firewalls so only a few bytes arrived.

Related errors

• mysql error packet too short
• mysql error packet truncated
• mysql handshake packet too short
• empty mysql greeting
• invalid mysql packet length %d

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/b26dc5aa1a0cd40e. Report an issue: GitHub.