{"record":{"id":"2bf4e23adf95d936","repo":"apache/cassandra","slug":"password-for-role-s-can-only-be-changed-every-sm","errorCode":null,"errorMessage":"Password for role %s can only be changed every %sms.","messagePattern":"Password for role (.+?) can only be changed every (.+?)ms\\.","errorType":"exception","errorClass":"OverloadedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraRoleManager.java","lineNumber":736,"sourceCode":"            ResultMessage.Rows rows = select(loadRoleWithWritetimeStatement, options);\n            boolean hasRecentPasswordUpdates = !rows.result.isEmpty();\n            if (hasRecentPasswordUpdates)\n            {\n                UntypedResultSet.Row row = UntypedResultSet.create(rows.result).one();\n\n                hasRecentPasswordUpdates = row.has(\"salted_hash_writetime\")\n                                           && PASSWORD_UPDATE_MIN_INTERVAL_MS >= (Clock.Global.currentTimeMillis() - TimeUnit.MICROSECONDS.toMillis(row.getLong(\"salted_hash_writetime\")));\n            }\n            if (!hasRecentPasswordUpdates)\n            {\n                recentPasswordUpdates.put(roleName, Boolean.TRUE);\n                logger.info(String.format(\"Password changing for role %s by %s\", roleName, performer.getName()));\n                return;\n            }\n        }\n        String failure = String.format(\"Password for role %s can only be changed every %sms.\", roleName, PASSWORD_UPDATE_MIN_INTERVAL_MS);\n        logger.warn(String.format(\"%s [performer: %s]\", failure, performer.getName()));\n        throw new OverloadedException(failure);\n    }\n\n    private static ByteBuffer byteBuf(String str)\n    {\n        return UTF8Type.instance.decompose(str);\n    }\n\n    /**\n     * Executes the provided query.\n     * This shouldn't be used during setup as this will directly return an error if the manager is not setup yet. Setup tasks\n     * should use QueryProcessor.process directly.\n     */\n    @VisibleForTesting\n    UntypedResultSet process(String query, ConsistencyLevel consistencyLevel)\n    throws RequestValidationException, RequestExecutionException\n    {\n        return QueryProcessor.process(query, consistencyLevel);\n    }","sourceCodeStart":718,"sourceCodeEnd":754,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L718-L754","documentation":"InvalidRequestException from enforcePasswordUpdateRateLimit (invoked by alterRole): the role's salted_hash writetime shows the password was changed within the configured minimum interval, so another change is rejected. The read compares PASSWORD_UPDATE_MIN_INTERVAL_MS against the elapsed time since salted_hash_writetime.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:736 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Wait until the minimum password update interval has elapsed since the last change","Change the password only once per interval window rather than repeatedly","Adjust the password update rate limit guardrail/setting if a legitimate operational need requires more frequent rotation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}