{"record":{"id":"43646b0d46a4c060","repo":"spring-projects/spring-security","slug":"no-such-hashing-algorithm","errorCode":null,"errorMessage":"No such hashing algorithm","messagePattern":"No such hashing algorithm","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/Digester.java","lineNumber":69,"sourceCode":"\t\tfor (int i = 0; i < this.iterations; i++) {\n\t\t\tvalue = messageDigest.digest(value);\n\t\t}\n\t\treturn value;\n\t}\n\n\tvoid setIterations(int iterations) {\n\t\tif (iterations <= 0) {\n\t\t\tthrow new IllegalArgumentException(\"Iterations value must be greater than zero\");\n\t\t}\n\t\tthis.iterations = iterations;\n\t}\n\n\tprivate static MessageDigest createDigest(String algorithm) {\n\t\ttry {\n\t\t\treturn MessageDigest.getInstance(algorithm);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(\"No such hashing algorithm\", ex);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":51,"sourceCodeEnd":74,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/Digester.java#L51-L74","documentation":"Digester.createDigest wraps MessageDigest.getInstance and converts the checked NoSuchAlgorithmException into an IllegalStateException with this message. It means the JVM's security providers cannot supply an implementation of the requested hashing algorithm (e.g. \"SHA-256\"), so hashing cannot proceed. In practice this almost only happens when the algorithm string is misspelled or the JDK lacks a provider for an exotic algorithm.","triggerScenarios":"Constructing Digester with an algorithm name no installed security provider supports, e.g. new Digester(\"SHA3-256\") on an old JDK, or a typo like new Digester(\"sha256\") where the provider rejects the exact name.","commonSituations":"Hard-coding an algorithm string from documentation for a different JDK version; running on a stripped-down JRE or FIPS-restricted environment missing standard providers; passing a non-standard algorithm name from configuration.","solutions":["Use an exact standard algorithm name supported by every modern JDK: \"MD5\", \"SHA-1\", or \"SHA-256\".","Print available algorithms via java.security.Security.getAlgorithms(\"MessageDigest\") and pick one that is listed.","If a newer algorithm is required (e.g. SHA-3), upgrade to a JDK/provider that supports it or register a provider such as BouncyCastle."],"exampleFix":"// before\nDigester digester = new Digester(\"sha256\");\n// after\nDigester digester = new Digester(\"SHA-256\");","handlingStrategy":"validation","validationCode":"boolean ok = java.security.Security.getAlgorithms(\"MessageDigest\").contains(\"SHA-256\");\nif (!ok) throw new IllegalStateException(\"SHA-256 unavailable in this JVM\");\nDigester d = new Digester(\"SHA-256\");","typeGuard":null,"tryCatchPattern":"try {\n    new Digester(algorithm);\n} catch (IllegalStateException e) {\n    // fall back to \"SHA-256\" and log the unsupported algorithm\n}","preventionTips":["Only use standard JCA algorithm names: MD5, SHA-1, SHA-256.","Assert required algorithms exist at application startup, not lazily at first hash."],"tags":["java","spring-security","crypto","jvm"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}