{"record":{"id":"2bff1d19da458283","repo":"apache/cassandra","slug":"attempted-to-read-a-range-containing-d-denylisted","errorCode":null,"errorMessage":"Attempted to read a range containing %d denylisted keys in %s/%s. Range read: %s","messagePattern":"Attempted to read a range containing (.+?) denylisted keys in (.+?)/(.+?)\\. Range read: (.+?)","errorType":"exception","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/StorageProxy.java","lineNumber":2835,"sourceCode":"        public String description()\n        {\n            return command.toCQLString();\n        }\n    }\n\n    public static PartitionIterator getRangeSlice(PartitionRangeReadCommand command,\n                                                  ConsistencyLevel consistencyLevel,\n                                                  ReadCoordinator readCoordinator,\n                                                  Dispatcher.RequestTime requestTime)\n    {\n        if (DatabaseDescriptor.getPartitionDenylistEnabled() && DatabaseDescriptor.getDenylistRangeReadsEnabled())\n        {\n            final int denylisted = partitionDenylist.getDeniedKeysInRangeCount(command.metadata().id, command.dataRange().keyRange());\n            if (denylisted > 0)\n            {\n                denylistMetrics.incrementRangeReadsRejected();\n                String tokens = command.loggableTokens();\n                throw new InvalidRequestException(String.format(\"Attempted to read a range containing %d denylisted keys in %s/%s.\" +\n                                                                \" Range read: %s\", denylisted, command.metadata().keyspace, command.metadata().name,\n                                                                tokens));\n            }\n        }\n        return RangeCommands.partitions(command, consistencyLevel, readCoordinator, requestTime);\n    }\n\n    public Map<String, List<String>> getSchemaVersions()\n    {\n        return describeSchemaVersions(false);\n    }\n\n    public Map<String, List<String>> getSchemaVersionsWithPort()\n    {\n        return describeSchemaVersions(true);\n    }\n\n    /**","sourceCodeStart":2817,"sourceCodeEnd":2853,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/StorageProxy.java#L2817-L2853","documentation":"InvalidRequestException thrown when a range/scan read would return keys that are on the partition denylist. partitionDenylist.getDeniedKeysInRangeCount() is checked before RangeCommands.partitions() and any count > 0 rejects the whole range read.","triggerScenarios":"Any range scan / secondary-index query / partition range query (e.g., SELECT without key restriction, nodetool scan) over a table whose token range contains at least one denylisted partition key.","commonSituations":"Analytics or repair-style scans running after an operator denylisted keys in the same token range; full-table scans on tables that had denylisted keys added during an incident.","solutions":["Check the loggable token list in the exception to identify the denylisted keys in the scanned range.","Remove denylisted entries if they are no longer meant to block reads.","Restrict the scan to sub-ranges that avoid denylisted keys, or query per-partition instead.","Review log for `readsRejected`/`rangeReadsRejected` denylist metrics to scope which ranges are affected."],"exampleFix":"// before\nResultSet rs = session.execute(\"SELECT * FROM ks.tbl\");\n// after\n// scan in bounded token sub-ranges that exclude denylisted keys\nResultSet rs = session.execute(\"SELECT * FROM ks.tbl WHERE token(pk) > ? AND token(pk) <= ?\", lo, hi);","handlingStrategy":"validation","validationCode":"int denied = (int) jmxConn.invoke(denylistMbean, \"getDeniedKeysInRangeCount\",\n        new Object[]{keyspace, table, loToken, hiToken},\n        new String[]{\"java.lang.String\",\"java.lang.String\",\"java.lang.String\",\"java.lang.String\"});\nif (denied > 0) narrowOrAbortScan(loToken, hiToken);","typeGuard":null,"tryCatchPattern":"catch (InvalidRequestException e) {\n    if (e.getMessage().contains(\"denylisted keys\")) {\n        String range = extractLoggedTokens(e.getMessage());\n        return scanSubRangesExcluding(range);\n    }\n    throw e;\n}","preventionTips":["Split full-table scans into bounded token sub-ranges.","Alert on denylistMetrics.rangeReadsRejected.","Track denylisted token ranges and exclude them from scheduled scans.","Coordinate denylist changes with analytics/scan job owners."],"tags":["cassandra","denylist","range-scan","invalid-request"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}