record_overflow
record_overflow (22) is sent when a TLS record exceeds the maximum allowed length. TLS 1.3 limits records to 2^14 + 256 bytes (16,640 bytes). TLS 1.2 limits records to 2^14 bytes (16,384 bytes) before encryption overhead. A record exceeding this limit triggers record_overflow immediately.
Alert Code
22
Level
Fatal
Standard
RFC 8446
Description
TLS defines a maximum record size of 2^14 bytes for the plaintext. RFC 8446 §5.1 additionally allows up to 256 bytes of padding in TLS 1.3, for a maximum encrypted record of 16,640 bytes. Receiving a record larger than this limit triggers record_overflow – it means either the peer has a bug in its record layer, or an attacker is injecting oversized records to exploit a potential buffer overflow in the TLS implementation. This alert was relevant in the BEAST and Lucky13 era but remains important today.
Common Causes
- –Peer's TLS implementation sends oversized records
- –Fragmentation logic bug producing records over 16,384 bytes
- –Injected oversized records in a MITM attack