sqlmapproject/sqlmap · error · KerberosError

KDC reply length exceeds the sane maximum

Error message

KDC reply length %d exceeds the sane maximum

What it means

Fires in _sendReceive when the 4-byte length prefix read from the KDC TCP stream exceeds a locally enforced sane maximum. RFC 4120 7.2.2 frames each reply with a big-endian length; a hostile or buggy KDC can advertise an absurd length to exhaust client memory, so the client rejects it before allocating.

Solutions

1. Verify the KDC address and port are the intended ones (a wrong service can send garbage frames).
2. Check for a middlebox/proxy corrupting the TCP stream.
3. If the KDC legitimately sends very large replies (huge PACs, many PAC options), raise the sane-maximum constant deliberately.
4. Capture traffic and inspect the length prefix and first reply bytes to confirm what the peer actually sent.

When it happens

Trigger: Thrown at extra/kerberos/client.py:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/6a572e8837c8735c. Report an issue: GitHub.

Appendix: source

Thrown at extra/kerberos/client.py:158

    return der.sequence(*parts)

# ---- KDC transport (RFC 4120 section 7.2.2: 4-byte length-prefixed over TCP) ----------------------
def _recvExactly(sock, count):
    buf = b""
    while len(buf) < count:
        chunk = sock.recv(count - len(buf))
        if not chunk:
            raise KerberosError(-1, "connection closed by KDC")
        buf += chunk
    return buf

def _sendReceive(host, port, request):
    sock = socket.create_connection((host, port), timeout=KDC_TIMEOUT)
    try:
        sock.sendall(struct.pack(">I", len(request)) + request)
        length = struct.unpack(">I", _recvExactly(sock, 4))[0]
        if length > MAX_KDC_RESPONSE:
            raise KerberosError(-1, "KDC reply length %d exceeds the sane maximum" % length)
        return _recvExactly(sock, length)
    finally:
        sock.close()

def _raiseIfError(message):
    tag, content, _ = der.peel(message)
    if tag == der.applicationTag(KRB_ERROR):
        fields = _fields(der.peel(content)[1])
        raise KerberosError(_expInteger(fields[6]) if 6 in fields else -1,
                            _expString(fields[11]) if 11 in fields else None)
    return tag, content

def _etypeHints(methodData):
    """Parse a METHOD-DATA TLV (SEQUENCE OF PA-DATA) into PA-ETYPE-INFO2 hints as
    {etype: (salt, iterations)}, telling us which etype/salt/s2kparams the KDC expects for the
    long-term key. The first entry for an etype wins; a malformed hint yields none (so the caller
    falls back to its defaults) rather than raising."""

View on GitHub (pinned to 0a35b20e39)