What causes "oracle server compile caps too short" in shadow1ng/fscan?

Verify against a standard Oracle server version the plugin is known to work with

oracle server compile caps too short

Error message

oracle server compile caps too short

What it means

The server reports its compiled-in capability flags in the compile-caps byte array. The library needs at least 8 bytes to safely interpret capability bits (EOS at index 15, FSAP at index 16 are optional and length-guarded). A shorter array means the server's capability data is malformed or the handshake is out of sync.

Source

Thrown at plugins/services/oracle_raw.go:1034

	serverNCharset := int(binary.BigEndian.Uint16(numArray[offset+3 : offset+5]))
	len2, err := s.getByte()
	if err != nil {
		return nil, err
	}
	compileCaps, err := s.getBytes(int(len2))
	if err != nil {
		return nil, err
	}
	len3, err := s.getByte()
	if err != nil {
		return nil, err
	}
	runtimeCaps, err := s.getBytes(int(len3))
	if err != nil {
		return nil, err
	}
	if len(compileCaps) < 8 {
		return nil, errors.New("oracle server compile caps too short")
	}
	if len(compileCaps) > 15 && compileCaps[15]&1 != 0 {
		s.hasEOSCapability = true
	}
	if len(compileCaps) > 16 && compileCaps[16]&1 != 0 {
		s.hasFSAPCapability = true
	}
	if len(compileCaps) > 37 && compileCaps[37]&32 != 0 {
		s.useBigClrChunks = true
		s.clrChunkSize = 0x7fff
	}
	return &oracleTCPNego{
		serverCharset:         serverCharset,
		serverFlags:           serverFlags | 2,
		serverNCharset:        serverNCharset,
		serverCompileTimeCaps: compileCaps,
		serverRuntimeCaps:     runtimeCaps,
	}, nil

View on GitHub (pinned to 95cc12e753)

Solutions

Verify against a standard Oracle server version the plugin is known to work with
Check whether earlier caps length fields (len2/len3) were read from the right offsets — fix any desync upstream
Test a direct connection bypassing proxies/firewalls that could truncate frames
Update plugin/server patch level; report with a wire capture if it persists

Example fix

// before
if len(compileCaps) < 8 {
	return nil, errors.New("oracle server compile caps too short")
}
// after
if len(compileCaps) < 8 {
	return nil, fmt.Errorf("oracle server compile caps too short: got %d bytes", len(compileCaps))
}

Defensive patterns

Strategy: try-catch

Try / catch

if err != nil && strings.Contains(err.Error(), "compile caps too short") {
	return fmt.Errorf("server capability data malformed or handshake desynced; verify server version and network path: %w", err)
}

Prevention

Use Oracle server versions the plugin is tested against
Bypass proxies when diagnosing negotiation failures
Fix any earlier field-length mis-parses that could shift the caps arrays

When it happens

Trigger: protocolNegotiation() during oracleRawAuth reads runtimeCaps via getBytes(len3) and then finds len(compileCaps) < 8.

Common situations: Very old or non-standard Oracle server builds with minimal capability data; proxy mangling the negotiation frames; earlier length fields parsed incorrectly shifting the caps arrays.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c87b673de509e11c. Report an issue: GitHub.