{"record":{"id":"0cd697e25aa8afcd","repo":"thanos-io/thanos","slug":"invalid-curve-s-valid-values-are-s","errorCode":null,"errorMessage":"invalid curve: %s, valid values are %s","messagePattern":"invalid curve: (.+?), valid values are (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":298,"sourceCode":"\t\t\"CurveP256\":          tls.CurveP256,\n\t\t\"CurveP384\":          tls.CurveP384,\n\t\t\"CurveP521\":          tls.CurveP521,\n\t\t\"X25519\":             tls.X25519,\n\t\t\"X25519MLKEM768\":     tls.X25519MLKEM768,\n\t\t\"SecP256r1MLKEM768\":  tls.SecP256r1MLKEM768,\n\t\t\"SecP384r1MLKEM1024\": tls.SecP384r1MLKEM1024,\n\t}\n\tvalidNames := make([]string, 0, len(curveMap))\n\tfor n := range curveMap {\n\t\tvalidNames = append(validNames, n)\n\t}\n\tsort.Strings(validNames)\n\n\tids := make([]tls.CurveID, 0, len(curves))\n\tfor _, name := range curves {\n\t\tid, ok := curveMap[name]\n\t\tif !ok {\n\t\t\treturn nil, errors.New(fmt.Sprintf(\"invalid curve: %s, valid values are %s\", name, strings.Join(validNames, \", \")))\n\t\t}\n\t\tids = append(ids, id)\n\t}\n\treturn ids, nil\n}\n\nfunc GetTlsVersion(tlsMinVersion string) (uint16, error) {\n\n\tvalidOption := validOption{\n\t\ttlsOption: map[string]uint16{\n\t\t\t\"1.0\": tls.VersionTLS10,\n\t\t\t\"1.1\": tls.VersionTLS11,\n\t\t\t\"1.2\": tls.VersionTLS12,\n\t\t\t\"1.3\": tls.VersionTLS13,\n\t\t},\n\t}\n\n\tif _, ok := validOption.tlsOption[tlsMinVersion]; !ok {","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L280-L316","documentation":"getCurveIDs maps elliptic-curve names from the TLS config to tls.CurveID values. An unrecognized curve name yields this error with the list of valid names. Strict validation of the curve-preferences option.","triggerScenarios":"NewServerConfig is called with an elliptic-curves list containing a name absent from curveMap (e.g. \"X448\", \"secp256k1\", OpenSSL-style names, or typos like \"P-521\" vs accepted spelling).","commonSituations":"Config copied from OpenSSL (which supports more curves than Go's TLS stack); including curves Go does not support (X448, secp256k1); inconsistent naming (P-256 vs CurveP256); config written for a different library version.","solutions":["Use only curve names listed in the error message (copy from valid values).","Remove unsupported curves such as X448 or secp256k1.","Normalize names to the library's expected spelling (e.g. P-256/P-384/P-521/X25519 per curveMap).","Align the config with the version of this library in use."],"exampleFix":"# before\ntls_elliptic_curves: X25519,X448\n# after\ntls_elliptic_curves: X25519,P-256","handlingStrategy":"validation","validationCode":"func validCurveNames(names []string, valid map[string]tls.CurveID) error {\n    for _, n := range names {\n        if _, ok := valid[n]; !ok {\n            return fmt.Errorf(\"unknown curve %q\", n)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"_, err := tls.NewServerConfig(logger, cipherSuites, curves, ver, ...)\nif err != nil && strings.Contains(err.Error(), \"invalid curve\") {\n    return fmt.Errorf(\"fix tls elliptic-curves config: %w\", err)\n}","preventionTips":["Use only Go-supported curves: P-256, P-384, P-521, X25519.","Avoid OpenSSL-only curves (X448, secp256k1).","Copy curve names from the error's valid-values list.","Lint TLS config keys against an allowlist."],"tags":["tls","config","validation","curves"],"backgroundTag":"invalid-enum-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}