What causes "short oracle charset negotiation" in shadow1ng/fscan?

Re-run the connection; if intermittent, fix the network path (proxy/MTU/packet loss)

short oracle charset negotiation

Error message

short oracle charset negotiation

What it means

In protocolNegotiation the server sends a variable-length data array carrying its charset (and later NCHARSET) settings. This library requires at least 11 bytes to read the fixed fields plus offsets; a shorter array means the server's response is malformed or the client/server negotiated an unexpected protocol shape.

Source

Thrown at plugins/services/oracle_raw.go:1010

	charsetElem, err := s.getInt(2, false, false)
	if err != nil {
		return nil, err
	}
	if charsetElem > 0 {
		if _, err = s.getBytes(charsetElem * 5); err != nil {
			return nil, err
		}
	}
	len1, err := s.getInt(2, false, true)
	if err != nil {
		return nil, err
	}
	numArray, err := s.getBytes(len1)
	if err != nil {
		return nil, err
	}
	if len(numArray) < 11 {
		return nil, errors.New("short oracle charset negotiation")
	}
	offset := int(6 + numArray[5] + numArray[6])
	if len(numArray) < offset+5 {
		return nil, errors.New("short oracle ncharset negotiation")
	}
	serverNCharset := int(binary.BigEndian.Uint16(numArray[offset+3 : offset+5]))
	len2, err := s.getByte()
	if err != nil {
		return nil, err
	}
	compileCaps, err := s.getBytes(int(len2))
	if err != nil {
		return nil, err
	}
	len3, err := s.getByte()
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 95cc12e753)

Solutions

Re-run the connection; if intermittent, fix the network path (proxy/MTU/packet loss)
Verify prior negotiation fields were consumed with correct lengths — a length mis-parse shrinks numArray
Compare behavior across server versions/instances to identify a server-side anomaly and report it
Update plugin and Oracle client/server patch levels

Example fix

// before
if len(numArray) < 11 {
	return nil, errors.New("short oracle charset negotiation")
}
// after
if len(numArray) < 11 {
	return nil, fmt.Errorf("short oracle charset negotiation: got %d bytes", len(numArray))
}

Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "short oracle charset negotiation") {
	// often transient truncation; retry once, then investigate network
	return retryWithBackoff(func() error { return connectAuth(dsn) }, 2)
}

Prevention

Rule out transport truncation (proxy, MTU) before assuming a server bug
Keep plugin/server versions aligned to avoid accept-packet layout drift
If persistent, capture the accept packet for upstream bug reports

When it happens

Trigger: protocolNegotiation() during oracleRawAuth calls s.getBytes(len1) and the returned numArray has fewer than 11 bytes.

Common situations: Truncated listener accept response over a lossy/proxied connection; unusual server builds that shorten the accept-data array; a desync from earlier mis-parsed negotiation fields.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/b66e6e43f7ffb0df. Report an issue: GitHub.