apache/cassandra · warning

Allowing java.lang.System.* access in UDFs is dangerous and…

Error message

Allowing java.lang.System.* access in UDFs is dangerous and not recommended. Set allow_extra_insecure_udfs: false to disable.

What it means

A warning logged when allow_extra_insecure_udfs is enabled in cassandra.yaml. This option permits UDF code to access java.lang.System.* (and other unsafe operations) without the sandbox restrictions Cassandra normally enforces, which is dangerous. The message advises disabling the option; startup continues.

Solutions

1. Set allow_extra_insecure_udfs: false in cassandra.yaml and rewrite UDFs that need java.lang.System.* access.
2. Keep UDFs sandboxed; avoid also disabling allow_insecure_udfs / UDF threads unless absolutely required.

Example fix

// cassandra.yaml before
allow_extra_insecure_udfs: true
// after
allow_extra_insecure_udfs: false

if (Boolean.TRUE.equals(yamlConfig.get("allow_extra_insecure_udfs"))) {
    throw new IllegalStateException("allow_extra_insecure_udfs is unsafe; rewrite UDFs instead of disabling the sandbox");
}

When it happens

Trigger: Starting a node with allow_extra_insecure_udfs: true; applySimpleConfig logs the warning while validating UDF-related settings (alongside allow_insecure_udfs and user_defined_functions_threads_enabled checks).

Common situations: Migrating UDFs from very old Cassandra versions that relied on unrestricted Java UDFs; disabling sandboxing to make legacy UDFs run; copying insecure dev configs into production.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• A maximum number of tokens per node is supported
• Access denied
• access denied: + MODIFY_THREAD_PERMISSION
• access denied: + MODIFY_THREADGROUP_PERMISSION
• access denied: + perm

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/026f5fae2c87b3e6. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/config/DatabaseDescriptor.java:1116

        indexSummaryCapacityInMiB = (conf.index_summary_capacity == null)
                                    ? Math.max(1, (int) (Runtime.getRuntime().totalMemory() * 0.05 / 1024 / 1024))
                                    : conf.index_summary_capacity.toMebibytes();

        if (indexSummaryCapacityInMiB < 0)
            throw new ConfigurationException("index_summary_capacity option was set incorrectly to '"
                                             + conf.index_summary_capacity.toString() + "', it should be a non-negative integer.", false);

        // we need this assignment for the Settings virtual table - CASSANDRA-17735
        conf.index_summary_capacity = new DataStorageSpec.LongMebibytesBound(indexSummaryCapacityInMiB);

        if (conf.user_defined_functions_fail_timeout.toMilliseconds() < conf.user_defined_functions_warn_timeout.toMilliseconds())
            throw new ConfigurationException("user_defined_functions_warn_timeout must less than user_defined_function_fail_timeout", false);

        if (!conf.allow_insecure_udfs && !conf.user_defined_functions_threads_enabled)
            throw new ConfigurationException("To be able to set enable_user_defined_functions_threads: false you need to set allow_insecure_udfs: true - this is an unsafe configuration and is not recommended.");

        if (conf.allow_extra_insecure_udfs)
            logger.warn("Allowing java.lang.System.* access in UDFs is dangerous and not recommended. Set allow_extra_insecure_udfs: false to disable.");

        if (conf.scripted_user_defined_functions_enabled)
            throw new ConfigurationException("JavaScript user-defined functions were removed in CASSANDRA-18252. " +
                                             "Hooks are planned to be introduced as part of CASSANDRA-17280");

        if (conf.commitlog_segment_size.toMebibytes() == 0)
            throw new ConfigurationException("commitlog_segment_size must be positive, but was "
                                             + conf.commitlog_segment_size.toString(), false);
        else if (conf.commitlog_segment_size.toMebibytes() >= 2048)
            throw new ConfigurationException("commitlog_segment_size must be smaller than 2048, but was "
                                             + conf.commitlog_segment_size.toString(), false);

        if (conf.max_mutation_size == null)
            conf.max_mutation_size = new DataStorageSpec.IntKibibytesBound(conf.commitlog_segment_size.toKibibytes() / 2);
        else if (conf.commitlog_segment_size.toKibibytes() < 2 * conf.max_mutation_size.toKibibytes())
            throw new ConfigurationException("commitlog_segment_size must be at least twice the size of max_mutation_size / 1024", false);

        if (conf.native_transport_max_message_size == null)

View on GitHub (pinned to 88fd0f6a0e)