CRYPTO_BUFFER_EXCEEDED
QUIC CRYPTO_BUFFER_EXCEEDED (0x0d) is sent when the total amount of TLS handshake data in CRYPTO frames exceeds the implementation's buffer limit. QUIC carries the TLS handshake in CRYPTO frames. Sending more TLS data than the peer can buffer terminates the connection.
Code
0x0d
Decimal
13
Standard
RFC 9000 §20
Description
QUIC carries the TLS 1.3 handshake in CRYPTO frames rather than TLS records. The handshake data (ClientHello, ServerHello, Certificates, etc.) is streamed via CRYPTO frames which have their own ordering and reassembly logic separate from application STREAM frames. CRYPTO frames do not have flow control limits like STREAM frames – there is no MAX_CRYPTO_DATA equivalent. Instead, RFC 9000 §7.5 specifies that implementations must buffer at least 4096 bytes of handshake data and should use CRYPTO_BUFFER_EXCEEDED if the buffer is exceeded. In practice, TLS handshake data rarely exceeds 4KB unless the certificate chain is very large (many intermediate certificates or a very large leaf certificate with embedded OCSP). CRYPTO_BUFFER_EXCEEDED in production typically indicates an unusually large certificate chain that needs trimming.
Common Causes
- –TLS certificate chain too large to fit in the CRYPTO frame buffer
- –Too many intermediate certificates in the chain
- –Large certificate extensions (CT logs, OCSP stapling) inflating certificate size
- –TLS session ticket or 0-RTT data exceeding buffer limits