{"record":{"id":"3894f2a85e32e16a","repo":"spring-projects/spring-security","slug":"amount-of-performance-parameters-invalid","errorCode":null,"errorMessage":"Amount of performance parameters invalid","messagePattern":"Amount of performance parameters invalid","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java","lineNumber":122,"sourceCode":"\t\tArgon2Parameters.Builder paramsBuilder;\n\t\tString[] parts = encodedHash.split(\"\\\\$\");\n\t\tif (parts.length < 4) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid encoded Argon2-hash\");\n\t\t}\n\t\tint currentPart = 1;\n\t\tparamsBuilder = switch (parts[currentPart++]) {\n\t\t\tcase \"argon2d\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_d);\n\t\t\tcase \"argon2i\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_i);\n\t\t\tcase \"argon2id\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);\n\t\t\tdefault -> throw new IllegalArgumentException(\"Invalid algorithm type: \" + parts[1]);\n\t\t};\n\t\tif (parts[currentPart].startsWith(\"v=\")) {\n\t\t\tparamsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));\n\t\t\tcurrentPart++;\n\t\t}\n\t\tString[] performanceParams = parts[currentPart++].split(\",\");\n\t\tif (performanceParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\t\tif (!performanceParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tparamsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));\n\t\tif (!performanceParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tparamsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));\n\t\tif (!performanceParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallelity parameter\");\n\t\t}\n\t\tparamsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));\n\t\tparamsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));\n\t\treturn new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());\n\t}\n\n\tpublic static class Argon2Hash {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java#L104-L140","documentation":"The performance-parameter segment of an Argon2 PHC hash must contain exactly three comma-separated components: m=<memory>, t=<iterations>, p=<parallelism>. If splitting that segment on ',' yields anything other than 3 items, decode() throws this IllegalArgumentException because the hash parameters cannot be reconstructed.","triggerScenarios":"Calling decode() on a hash where the parameter segment lacks or has extra comma-separated fields — e.g. '$argon2id$v=19$65536$...' (missing t= and p=), or hand-edited hashes with an extra token.","commonSituations":"Hashes generated by non-conforming tools or libraries writing abbreviated parameters; manual truncation during debugging; copy/paste that dropped part of the string.","solutions":["Regenerate the hash with Spring Security's Argon2PasswordEncoder or another spec-compliant Argon2 implementation","Inspect the hash string and confirm the third segment looks like 'm=65536,t=3,p=1'","Reject malformed hashes at the storage boundary and force a password reset for affected users"],"exampleFix":"// before\nArgon2Hash h = Argon2EncodingUtils.decode(\"$argon2id$v=19$65536$salt$hash\"); // params segment missing\n// after\nArgon2Hash h = Argon2EncodingUtils.decode(\"$argon2id$v=19$m=65536,t=3,p=1$c2FsdA$aGFzaA\");","handlingStrategy":"validation","validationCode":"static boolean hasThreeParams(String encodedHash) {\n    String[] parts = encodedHash.split(\"\\\\$\");\n    return parts.length >= 3 && parts[2].split(\",\").length == 3;\n}","typeGuard":null,"tryCatchPattern":"try {\n    return Argon2EncodingUtils.decode(hash);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Malformed Argon2 hash parameters\");\n    return null;\n}","preventionTips":["Regenerate hashes with spec-compliant encoders only","Regex-validate the full PHC format before persisting","Treat unparseable hashes as 'must reset password' records"],"tags":["argon2","password-hashing","input-validation","java","spring-security"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}