apache/dubbo · error · IllegalArgumentException

not an valid CIDR format!

Error message

not an valid CIDR format!

What it means

Thrown by the CIDRUtils constructor when the input string does not contain a '/' separator. A CIDR block must be 'address/prefix' (e.g. '192.168.0.0/16'); the slash separates the base address from the prefix length. Without it the constructor cannot split the two parts and rejects the input as malformed.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/CIDRUtils.java:61

    private final int prefixLength;


    public CIDRUtils(String cidr) throws UnknownHostException {

        this.cidr = cidr;

        /* split CIDR to address and prefix part */
        if (this.cidr.contains("/")) {
            int index = this.cidr.indexOf("/");
            String addressPart = this.cidr.substring(0, index);
            String networkPart = this.cidr.substring(index + 1);

            inetAddress = InetAddress.getByName(addressPart);
            prefixLength = Integer.parseInt(networkPart);

            calculate();
        } else {
            throw new IllegalArgumentException("not an valid CIDR format!");
        }
    }


    private void calculate() throws UnknownHostException {

        ByteBuffer maskBuffer;
        int targetSize;
        if (inetAddress.getAddress().length == 4) {
            maskBuffer =
                    ByteBuffer
                            .allocate(4)
                            .putInt(-1);
            targetSize = 4;
        } else {
            maskBuffer = ByteBuffer.allocate(16)
                    .putLong(-1L)
                    .putLong(-1L);

View on GitHub (pinned to 3a3043227f)

Solutions

1. Add the '/prefix' suffix: for a single host use '/32' (IPv4) or '/128' (IPv6); for a subnet use the correct prefix (e.g. '/24').
2. Validate the input contains '/' before constructing CIDRUtils.
3. If a bare IP is legitimately intended (single host), append '/32' (IPv4) explicitly.

Example fix

// before
new CIDRUtils("192.168.1.0"); // throws: no slash

// after
new CIDRUtils("192.168.1.0/24"); // subnet
new CIDRUtils("192.168.1.5/32"); // single host

String cidr = "...";
if (cidr == null || !cidr.contains("/")) {
    throw new IllegalArgumentException("CIDR must be 'address/prefix', e.g. '192.168.0.0/16'");
}
new CIDRUtils(cidr);

static boolean isCidrFormat(String s) {
    return s != null && s.contains("/")
        && s.indexOf('/') < s.length() - 1;
}

When it happens

Trigger: new CIDRUtils(cidr) where cidr.contains("/") is false — e.g. '192.168.1.0', '10.0.0.0', 'localhost'. The constructor only proceeds if the slash is present; any plain IP or hostname string is rejected.

Common situations: A trust/allowlist IP filter configured with a bare IP instead of a CIDR (e.g. '192.168.1.0' instead of '192.168.1.0/24'); a config property sourced from an env var or YAML that omits the prefix; copy-paste of an IP where a network range was intended.

Related errors

• '${key}' doesn't map to an existing object
• tickDuration must be greater than 0: {}
• ticksPerWheel must be greater than 0: {}
• Illegal Argument pattern or hostName. Pattern:${pattern}, Ho
• There is wrong format of ip Address: ${mask[i]}

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/67b5d57fe936c1b4. Report an issue: GitHub.