{"record":{"id":"7457c518f0bbdb6a","repo":"apache/cassandra","slug":"unable-to-read-denylisted-partition-0x-s-in-s","errorCode":null,"errorMessage":"Unable to read denylisted partition [0x%s] in %s/%s","messagePattern":"Unable to read denylisted partition \\[0x(.+?)\\] in (.+?)/(.+?)","errorType":"exception","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/service/StorageProxy.java","lineNumber":2184,"sourceCode":"    {\n        return PartitionIterators.getOnlyElement(read(SinglePartitionReadCommand.Group.one(command), consistencyLevel, requestTime), command);\n    }\n\n    /**\n     * Performs the actual reading of a row out of the StorageService, fetching\n     * a specific set of column names from a given column family.\n     */\n    public static PartitionIterator read(SinglePartitionReadCommand.Group group, ConsistencyLevel consistencyLevel, Dispatcher.RequestTime requestTime)\n    throws UnavailableException, IsBootstrappingException, ReadFailureException, ReadTimeoutException, InvalidRequestException\n    {\n        if (DatabaseDescriptor.getPartitionDenylistEnabled() && DatabaseDescriptor.getDenylistReadsEnabled())\n        {\n            for (SinglePartitionReadCommand command : group.queries)\n            {\n                if (!partitionDenylist.isKeyPermitted(command.metadata().id, command.partitionKey().getKey()))\n                {\n                    denylistMetrics.incrementReadsRejected();\n                    throw new InvalidRequestException(String.format(\"Unable to read denylisted partition [0x%s] in %s/%s\",\n                                                                    command.partitionKey().toString(), command.metadata().keyspace, command.metadata().name));\n                }\n            }\n        }\n\n        return consistencyLevel.isSerialConsistency()\n             ? readWithConsensus(group, consistencyLevel, requestTime)\n             : dispatchReadWithRetryOnDifferentSystem(group, consistencyLevel, ReadCoordinator.DEFAULT, requestTime);\n    }\n\n    public static boolean hasJoined()\n    {\n        ClusterMetadata metadata = ClusterMetadata.current();\n        if (metadata == null)\n            return false;\n\n        if (metadata.myNodeId() == NodeId.UNREGISTERED)\n            return false;","sourceCodeStart":2166,"sourceCodeEnd":2202,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/service/StorageProxy.java#L2166-L2202","documentation":"InvalidRequestException thrown before executing a single-partition read when the partition key is on the partition denylist. The denylist feature (partition_denylist) blocks reads of specific partitions, counting the rejection in denylistMetrics.readsRejected.","triggerScenarios":"Any SinglePartitionReadCommand (SELECT by full primary key, or LWT read) issued against a table/key that an operator added via nodetool denylist or the denylist JMX/API.","commonSituations":"Application still reading a key that security/incident-response put on the denylist after data corruption or a bad-data incident; denylist left enabled after remediation; tests run against tables that have denylisted entries from earlier experiments.","solutions":["Confirm the key is denylisted: `nodetool isdenylisted <keyspace> <table> <partitionKey>`.","Remove the entry if the read is legitimate: `nodetool allowlist` / remove via denylist JMX operation, or update partition_denylist configuration.","Change application queries to stop touching the denylisted partition key.","If denylisting was accidental, fix cassandra.yaml (partition_denylist_entries / denylist files) and reload."],"exampleFix":"// before\nResultSet rs = session.execute(\"SELECT * FROM ks.tbl WHERE pk = ?\", denylistedKey);\n// after\nif (!denylistService.isKeyDenied(denylistedKey)) {\n    ResultSet rs = session.execute(\"SELECT * FROM ks.tbl WHERE pk = ?\", denylistedKey);\n} else { /* use remediated key or fail fast */ }","handlingStrategy":"validation","validationCode":"boolean denied = (boolean) jmxConn.invoke(denylistMbean, \"isPartitionDenylisted\",\n        new Object[]{keyspace, table, partitionKeyHex}, new String[]{\"java.lang.String\",\"java.lang.String\",\"java.lang.String\"});\nif (denied) skipRead(partitionKeyHex);","typeGuard":null,"tryCatchPattern":"catch (InvalidRequestException e) {\n    if (e.getMessage().contains(\"denylisted partition\")) {\n        metrics.denylistedReadRejected();\n        return null; // or route to remediation path\n    }\n    throw e;\n}","preventionTips":["Keep the application's key inventory synced with the denylist after incidents.","Alert on denylistMetrics.readsRejected to detect stale app queries.","Remove denylist entries once remediation completes.","Document denylisted keys for the app team before denying reads."],"tags":["cassandra","denylist","read-rejected","invalid-request"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}