apache/cassandra · error · ConfigurationException

Illegal sequence length can not be lower than %s.

Error message

Illegal sequence length can not be lower than %s.

What it means

Thrown as a ConfigurationException when the illegal_sequence_length password-guardrail parameter is set below IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH. The check rejects configurations that would make sequence detection meaningless; the message states the minimum allowed value.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:215

            throw getValidationException(DIGIT_WARN_KEY,
                                         digitsWarn,
                                         DIGIT_FAIL_KEY,
                                         digitsFail);

        if (upperCaseWarn <= upperCaseFail)
            throw getValidationException(UPPER_CASE_WARN_KEY,
                                         upperCaseWarn,
                                         UPPER_CASE_FAIL_KEY,
                                         upperCaseFail);

        if (lowerCaseWarn <= lowerCaseFail)
            throw getValidationException(LOWER_CASE_WARN_KEY,
                                         lowerCaseWarn,
                                         LOWER_CASE_FAIL_KEY,
                                         lowerCaseFail);

        if (illegalSequenceLength < IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH)
            throw new ConfigurationException(format("Illegal sequence length can not be lower than %s.",
                                                    IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH));

        if (characteristicsWarn > 4)
            throw new ConfigurationException(format("%s can not be bigger than %s",
                                                    CHARACTERISTIC_WARN_KEY,
                                                    MAX_CHARACTERISTICS));

        if (characteristicsFail > 4)
            throw new ConfigurationException(format("%s can not be bigger than %s",
                                                    CHARACTERISTIC_FAIL_KEY,
                                                    MAX_CHARACTERISTICS));

        if (characteristicsFail == characteristicsWarn)
            throw new ConfigurationException(format("%s can not be equal to %s. You set %s and %s respectively.",
                                                    CHARACTERISTIC_FAIL_KEY,
                                                    CHARACTERISTIC_WARN_KEY,
                                                    characteristicsFail,
                                                    characteristicsWarn));

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Raise illegal_sequence_length in cassandra.yaml to at least IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH
2. Remove the setting to use the default sequence length
3. Consult the guardrail documentation for the exact minimum before tuning

Example fix

// before
password_guardrails:
  illegal_sequence_length: 2
// after
password_guardrails:
  illegal_sequence_length: 3

if (illegalSequenceLength < IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH)
    throw new ConfigurationException("Illegal sequence length can not be lower than " + IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH);

When it happens

Trigger: Setting illegal_sequence_length in cassandra.yaml password guardrails to a value smaller than the library's minimum (e.g. 1 or 2), causing validateParameters to fail at startup/construction.

Common situations: Admins trying to detect 2-character sequences; misunderstanding the parameter as 'max sequence allowed' rather than the detection window length; copying a config tuned from another deployment.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• must be positive.
• The shortest password to pass the warning validator for any
• Invalid guardrails configuration:
• default_keyspace_rf to be set (%d) cannot be less than minim
• default_keyspace_rf to be set (%d) cannot be greater than ma

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/0b6dca4ccdd7253d. Report an issue: GitHub.