{"record":{"id":"43a54b1958598922","repo":"apache/hadoop","slug":"md5-algorithm-not-available","errorCode":null,"errorMessage":"MD5 algorithm not available","messagePattern":"MD5 algorithm not available","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsOutputStream.java","lineNumber":227,"sourceCode":"    this.outputStreamId = createOutputStreamId();\n    this.tracingContext = new TracingContext(abfsOutputStreamContext.getTracingContext());\n    this.tracingContext.setStreamID(outputStreamId);\n    this.tracingContext.setOperation(FSOperationType.WRITE);\n    this.ioStatistics = outputStreamStatistics.getIOStatistics();\n    this.blockFactory = abfsOutputStreamContext.getBlockFactory();\n    this.isDFSToBlobFallbackEnabled\n        = abfsOutputStreamContext.isDFSToBlobFallbackEnabled();\n    this.serviceTypeAtInit = abfsOutputStreamContext.getIngressServiceType();\n    this.currentExecutingServiceType = abfsOutputStreamContext.getIngressServiceType();\n    this.clientHandler = abfsOutputStreamContext.getClientHandler();\n    createIngressHandler(serviceTypeAtInit,\n        abfsOutputStreamContext.getBlockFactory(), bufferSize, false, null);\n    try {\n      md5 = MessageDigest.getInstance(MD5);\n      fullBlobContentMd5 = MessageDigest.getInstance(MD5);\n    } catch (NoSuchAlgorithmException e) {\n      if (isChecksumValidationEnabled()) {\n        throw new IOException(\"MD5 algorithm not available\", e);\n      }\n    }\n  }\n\n  /**\n   * Retrieves the current ingress handler.\n   *\n   * @return the current {@link AzureIngressHandler}.\n   */\n  public AzureIngressHandler getIngressHandler() {\n    return ingressHandler;\n  }\n\n  private final Lock lock = new ReentrantLock();\n\n  private volatile boolean switchCompleted = false;\n\n  /**","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsOutputStream.java#L209-L245","documentation":"AbfsOutputStream's constructor creates MessageDigest.getInstance(\"MD5\") digests for incremental and full-blob checksums. If the JVM's security providers do not supply MD5 (NoSuchAlgorithmException) AND fs.azure.enable.checksum.validation is true, it throws IOException(\"MD5 algorithm not available\", e). With validation disabled (the default, DEFAULT_ENABLE_ABFS_CHECKSUM_VALIDATION = false) the missing digest is tolerated.","triggerScenarios":"Running on a FIPS 140-2/140-3-enforced JVM (e.g., BouncyCastle FIPS provider) where MD5 is disabled by policy; a custom java.security provider list that omits SUN/MessageDigest MD5; hardened container base images that strip algorithms; unusual JREs with restricted crypto policies.","commonSituations":"Regulated environments (government, finance, healthcare) booting Hadoop workers on FIPS mode; JVM upgrades that changed default security providers; Docker base images built with restricted java.security.","solutions":["Set fs.azure.enable.checksum.validation to false (it is the default) unless MD5 validation is required","If validation is required, run on a JVM/provider set where MD5 is permitted (FIPS policy exception or non-FIPS JVM)","Verify with a quick probe: MessageDigest.getInstance(\"MD5\") in the target JVM"],"exampleFix":"<!-- before -->\n<property>\n  <name>fs.azure.enable.checksum.validation</name>\n  <value>true</value>\n</property>\n\n<!-- after -->\n<property>\n  <name>fs.azure.enable.checksum.validation</name>\n  <value>false</value>\n</property>","handlingStrategy":"validation","validationCode":"// Probe MD5 availability before enabling checksum validation\nboolean md5Ok;\ntry {\n  java.security.MessageDigest.getInstance(\"MD5\");\n  md5Ok = true;\n} catch (java.security.NoSuchAlgorithmException e) {\n  md5Ok = false;\n}\nconf.setBoolean(\"fs.azure.enable.checksum.validation\",\n    md5Ok && wantChecksumValidation);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Leave fs.azure.enable.checksum.validation false (the default) on FIPS JVMs","Probe MessageDigest.getInstance(\"MD5\") in JVM smoke tests for restricted runtimes","Know your base image's java.security provider list before enabling MD5 features"],"tags":["azure-blob","abfs","checksum","md5","fips","jvm-security","configuration","hadoop"],"backgroundTag":"unsupported-crypto-algorithm","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}