{"record":{"id":"7a72a414fb4f874d","repo":"t8y2/dbx","slug":"sha-256-is-unavailable","errorCode":null,"errorMessage":"SHA-256 is unavailable","messagePattern":"SHA-256 is unavailable","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"agents/common/src/main/java/com/dbx/agent/JdbcConnectionPoolRegistry.java","lineNumber":224,"sourceCode":"        pools.clear();\n        checkoutExecutor.close();\n        connectionReleaseExecutor.close();\n        poolCloseExecutor.close();\n        physicalConnectionOpener.close();\n        physicalConnectionCloser.close();\n    }\n\n    private static String digest(String identity) {\n        try {\n            byte[] hash = MessageDigest.getInstance(\"SHA-256\").digest(identity.getBytes(StandardCharsets.UTF_8));\n            StringBuilder result = new StringBuilder(hash.length * 2);\n            for (byte value : hash) {\n                result.append(Character.forDigit((value >>> 4) & 0x0f, 16));\n                result.append(Character.forDigit(value & 0x0f, 16));\n            }\n            return result.toString();\n        } catch (Exception error) {\n            throw new IllegalStateException(\"SHA-256 is unavailable\", error);\n        }\n    }\n\n    private static ThreadFactory daemonThreadFactory(String name) {\n        return runnable -> {\n            Thread thread = new Thread(runnable, name);\n            thread.setDaemon(true);\n            return thread;\n        };\n    }\n\n    private static ExecutorService boundedExecutor(int maximumThreads, String name) {\n        int threads = Math.max(1, maximumThreads);\n        return new ThreadPoolExecutor(\n            threads,\n            threads,\n            0L,\n            TimeUnit.MILLISECONDS,","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/common/src/main/java/com/dbx/agent/JdbcConnectionPoolRegistry.java#L206-L242","documentation":"JdbcConnectionPoolRegistry.digest() keys each pool by a SHA-256 hash of the identity string. MessageDigest.getInstance(\"SHA-256\") throwing means the JRE cannot supply that algorithm, so digest() wraps the failure in IllegalStateException(\"SHA-256 is unavailable\"). This is an environment/JRE problem, not a data problem.","triggerScenarios":"Any borrow()/poolCount()/hasActiveLeases() call when MessageDigest.getInstance(\"SHA-256\") fails — running on a stripped-down JRE without the SUN/MD provider, a misconfigured java.security file removing the provider, or a classloading/registry failure of the security provider.","commonSituations":"Deploying to a minimal/jlink-trimmed runtime or hardened container with removed crypto providers; a corrupted or overly restrictive java.security policy disabling SHA-2 family algorithms (e.g. legacy FIPS setups); broken JDK installation.","solutions":["Run on a standard JRE/JDK (11+) that includes the SUN provider with SHA-256; verify with MessageDigest.getInstance(\"SHA-256\") in a smoke test.","Inspect java.security (jdk.home/conf/security) and re-enable the SUN provider / remove jdk.certpath/jdk.tls disabledAlgorithms entries that block SHA-256.","If a FIPS provider is required, register a provider that supplies SHA-256 (e.g. BouncyCastle FIPS) via security.provider config.","As a stopgap, precompute/replace the digest with an application-supplied key derivation so borrow() never invokes MessageDigest."],"exampleFix":"// before (java.security)\n#security.provider.1=sun.security.provider.Sun\n// after\nsecurity.provider.1=sun.security.provider.Sun","handlingStrategy":"validation","validationCode":"try {\n    java.security.MessageDigest.getInstance(\"SHA-256\");\n} catch (java.security.NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"Runtime JRE lacks SHA-256; fix providers before starting\", e);\n}","typeGuard":"static boolean sha256Available() {\n    try {\n        return java.security.MessageDigest.getInstance(\"SHA-256\") != null;\n    } catch (java.security.NoSuchAlgorithmException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    return registry.borrow(identity, factory);\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"SHA-256 is unavailable\")) {\n        throw new FatalStartupError(\"JRE lacks SHA-256; check security providers\", e);\n    }\n    throw e;\n}","preventionTips":["Startup smoke test: resolve SHA-256 MessageDigest before accepting traffic.","Avoid jlink/trimmed runtimes that drop the SUN crypto provider.","Review java.security and disabledAlgorithms after hardening or FIPS changes.","Pin a standard JDK distribution (Temurin, etc.) in deployment images."],"tags":["security","jre","message-digest","environment"],"backgroundTag":"algorithm-not-available","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}