What causes "%s can not be bigger than %s" in apache/cassandra?

Set characteristics_warn in cassandra.yaml to a value between 1 and 4

apache/cassandra · error · ConfigurationException

%s can not be bigger than %s

Error message

%s can not be bigger than %s

What it means

Thrown as a ConfigurationException when the password-guardrail characteristicsWarn parameter exceeds 4 (MAX_CHARACTERISTICS). Only four password characteristics exist (uppercase, lowercase, digits, specials), so a warn threshold above 4 is impossible to satisfy. The message is '%s can not be bigger than %s' with the characteristic warn key and the max.

Source

Thrown at src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java:219

        if (upperCaseWarn <= upperCaseFail)
            throw getValidationException(UPPER_CASE_WARN_KEY,
                                         upperCaseWarn,
                                         UPPER_CASE_FAIL_KEY,
                                         upperCaseFail);

        if (lowerCaseWarn <= lowerCaseFail)
            throw getValidationException(LOWER_CASE_WARN_KEY,
                                         lowerCaseWarn,
                                         LOWER_CASE_FAIL_KEY,
                                         lowerCaseFail);

        if (illegalSequenceLength < IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH)
            throw new ConfigurationException(format("Illegal sequence length can not be lower than %s.",
                                                    IllegalSequenceRule.MINIMUM_SEQUENCE_LENGTH));

        if (characteristicsWarn > 4)
            throw new ConfigurationException(format("%s can not be bigger than %s",
                                                    CHARACTERISTIC_WARN_KEY,
                                                    MAX_CHARACTERISTICS));

        if (characteristicsFail > 4)
            throw new ConfigurationException(format("%s can not be bigger than %s",
                                                    CHARACTERISTIC_FAIL_KEY,
                                                    MAX_CHARACTERISTICS));

        if (characteristicsFail == characteristicsWarn)
            throw new ConfigurationException(format("%s can not be equal to %s. You set %s and %s respectively.",
                                                    CHARACTERISTIC_FAIL_KEY,
                                                    CHARACTERISTIC_WARN_KEY,
                                                    characteristicsFail,
                                                    characteristicsWarn));

        if (characteristicsFail > characteristicsWarn)
            throw new ConfigurationException(format("%s can not be bigger than %s. You have set %s and %s respectively.",
                                                    CHARACTERISTIC_FAIL_KEY,

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Set characteristics_warn in cassandra.yaml to a value between 1 and 4
Remove the parameter to use defaults
Re-read the count of password characteristics in the guardrail docs before tuning

Example fix

// before
password_guardrails:
  characteristics_warn: 5
// after
password_guardrails:
  characteristics_warn: 3

Defensive patterns

Strategy: validation

Validate before calling

if (characteristicsWarn > MAX_CHARACTERISTICS)
    throw new ConfigurationException("characteristics_warn can not be bigger than " + MAX_CHARACTERISTICS);

Prevention

Remember only 4 characteristics exist (uppercase, lowercase, digits, specials)
Clamp values to 1..4 in config generation tooling
Validate the whole guardrail block together, not key by key

When it happens

Trigger: Setting characteristics_warn to 5 or higher in cassandra.yaml password guardrails; validateParameters runs at configuration load and rejects it.

Common situations: Admins not realizing there are only 4 characteristics; converting configs that counted more categories in other password tools; off-by-one confusion ('require all 4' entered as 5).

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/58d24f954a80632b. Report an issue: GitHub.