{"record":{"id":"06d8e106a15dd824","repo":"eclipse-vertx/vert.x","slug":"invalid-reset-code-value","errorCode":null,"errorMessage":"Invalid reset code value","messagePattern":"Invalid reset code value","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/http/impl/http2/DefaultHttp2Stream.java","lineNumber":433,"sourceCode":"    bytesWritten += numOfBytes;\n    if (end) {\n      trailersSent = true;\n      StreamObserver observer = observer();\n      if (observer != null) {\n        observer.observeOutboundTrailers(bytesWritten);\n      }\n    }\n    connection.writeData(id, chunk, end, promise);\n  }\n\n  @Override\n  public Future<Boolean> cancel() {\n    return writeReset(0x08L).map(true);\n  }\n\n  public final Future<Void> writeReset(long code) {\n    if (code < 0L) {\n      throw new IllegalArgumentException(\"Invalid reset code value\");\n    }\n    Promise<Void> promise = context.promise();\n    EventLoop eventLoop = connection.context().nettyEventLoop();\n    if (eventLoop.inEventLoop()) {\n      writeReset0(code, promise);\n    } else {\n      eventLoop.execute(() -> writeReset0(code, promise));\n    }\n    return promise.future();\n  }\n\n  private void writeReset0(long code, Promise<Void> promise) {\n    if (trailersSent && trailersReceived) {\n      promise.fail(\"Request ended\");\n    } else {\n      if (reset != -1L) {\n        promise.fail(\"Stream already reset\");\n      } else {","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/http/impl/http2/DefaultHttp2Stream.java#L415-L451","documentation":"DefaultHttp2Stream.writeReset validates the RST_STREAM error code and rejects negative values. HTTP/2 reset codes (RFC 7540 section 7) are unsigned 32-bit values; a negative long cannot be encoded in the frame. Vert.x throws IllegalArgumentException immediately before scheduling the reset write.","triggerScenarios":"Calling stream.writeReset(code) with a negative long, e.g. passing -1 as a sentinel or an unvalidated integer parsed from config/input.","commonSituations":"Application-defined error codes computed by subtraction that underflow; forwarding untrusted reset codes from user input; using Java int codes cast with a sign issue.","solutions":["Pass only valid HTTP/2 error codes (0 to 0xFFFFFFFF, e.g. Http2Error values like 0x08 CANCEL).","Validate/normalize the code before calling writeReset: clamp or reject negatives.","If a sentinel is needed, use a standard code such as 0x08 (CANCEL) or 0x00 (NO_ERROR)."],"exampleFix":"// before\nstream.writeReset(-1);\n// after\nif (code < 0) code = 0x08; // CANCEL\nstream.writeReset(code);","handlingStrategy":"validation","validationCode":"if (code < 0 || code > 0xFFFFFFFFL) throw new IllegalArgumentException(\"bad reset code\");","typeGuard":"boolean isValidResetCode(long c) { return c >= 0 && c <= 0xFFFFFFFFL; }","tryCatchPattern":"try { stream.writeReset(code); } catch (IllegalArgumentException e) { stream.writeReset(0x08); }","preventionTips":["Use named constants (Http2Error.CANCEL etc.) instead of raw numbers","Validate codes parsed from user input","Never use -1 as sentinel for error codes","Add range assertions in code-producing logic"],"tags":["http2","rst-stream","argument-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}