{"record":{"id":"086f554045f92bb3","repo":"apache/cassandra","slug":"invalid-ip-address-while-deserializing-inet-addres","errorCode":null,"errorMessage":"Invalid IP address while deserializing inet address","messagePattern":"Invalid IP address while deserializing inet address","errorType":"exception","errorClass":"org.apache.cassandra.transport.ProtocolException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/transport/CBUtil.java","lineNumber":718,"sourceCode":"\n    public static int sizeOfInet(InetSocketAddress inet)\n    {\n        byte[] address = inet.getAddress().getAddress();\n        return 1 + address.length + 4;\n    }\n\n    public static InetAddress readInetAddr(ByteBuf cb)\n    {\n        int addressSize = cb.readByte() & 0xFF;\n        byte[] address = new byte[addressSize];\n        cb.readBytes(address);\n        try\n        {\n            return InetAddress.getByAddress(address);\n        }\n        catch (UnknownHostException e)\n        {\n            throw new ProtocolException(\"Invalid IP address while deserializing inet address\");\n        }\n    }\n\n    public static void writeInetAddr(InetAddress inetAddr, ByteBuf cb)\n    {\n        byte[] address = inetAddr.getAddress();\n        cb.writeByte(address.length);\n        cb.writeBytes(address);\n    }\n\n    public static int sizeOfInetAddr(InetAddress inetAddr)\n    {\n        return 1 + inetAddr.getAddress().length;\n    }\n\n    /*\n     * Reads *all* readable bytes from {@code cb} and return them.\n     */","sourceCodeStart":700,"sourceCodeEnd":736,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/transport/CBUtil.java#L700-L736","documentation":"Same family as the inet-socket deserialization error: CBUtil reads an address byte array from a protocol frame and calls InetAddress.getByAddress, which rejects arrays that are not 4 or 16 bytes long, resulting in this ProtocolException. The connection is closed with an ERROR frame.","triggerScenarios":"A frame contains an inet address field with an invalid byte-array length (not 4 or 16), typically from a malformed client-side serialization.","commonSituations":"Custom CQL drivers, protocol fuzzing, bytecode-corrupting proxies, or a driver bug writing UDT/collection values containing inet elements.","solutions":["Ensure the address byte array is exactly 4 bytes for IPv4 or 16 bytes for IPv6 before sending.","Upgrade/fix the client driver; verify it uses the standard inet serialization (length-prefixed bytes + port where applicable).","Enable driver debug logging and server-side protocol tracing to identify the malformed frame.","Send the value through an official driver instead of hand-rolled serialization."],"exampleFix":"// before\nbyte[] bad = new byte[]{1,2,3}; // 3 bytes -> UnknownHostException\n// after\nbyte[] ok = InetAddress.getByName(\"192.168.1.5\").getAddress(); // always 4 or 16 bytes","handlingStrategy":"validation","validationCode":"byte[] address = ...;\nif (address == null || (address.length != 4 && address.length != 16))\n    throw new IllegalArgumentException(\"Address bytes must be exactly 4 (IPv4) or 16 (IPv6) bytes long\");","typeGuard":"boolean isValidInetAddr(byte[] a) { return a != null && (a.length == 4 || a.length == 16); }","tryCatchPattern":"try { session.execute(...); } catch (ProtocolException e) {\n    log.error(\"Invalid inet bytes sent; check serialization\", e);\n}","preventionTips":["Serialize inet values through InetAddress.getAddress() only.","Test round-trip (write then read) of inet values in both IPv4 and IPv6.","Keep driver and server versions aligned.","Avoid custom middleware that rewrites CQL frame bodies."],"tags":["network","protocol","deserialization","cql-native-protocol"],"backgroundTag":"invalid-argument-format","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}