{"record":{"id":"83bc42ccf3f3cd10","repo":"elastic/elasticsearch","slug":"unexpected-exception-creating-messagedigest-instan-83bc42","errorCode":null,"errorMessage":"unexpected exception creating MessageDigest instance for [{}]","messagePattern":"unexpected exception creating MessageDigest instance for \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/FingerprintProcessor.java","lineNumber":260,"sourceCode":"            String method = ConfigurationUtils.readStringProperty(TYPE, processorTag, config, \"method\", DEFAULT_METHOD);\n            if (Arrays.asList(SUPPORTED_DIGESTS).contains(method) == false) {\n                throw newConfigurationException(\n                    TYPE,\n                    processorTag,\n                    \"method\",\n                    String.format(\n                        Locale.ROOT,\n                        \"[%s] must be one of the supported hash methods [%s]\",\n                        method,\n                        Strings.arrayToCommaDelimitedString(SUPPORTED_DIGESTS)\n                    )\n                );\n            }\n            ThreadLocal<Hasher> threadLocalHasher = ThreadLocal.withInitial(() -> {\n                try {\n                    return MessageDigestHasher.getInstance(method);\n                } catch (NoSuchAlgorithmException e) {\n                    throw new IllegalStateException(\"unexpected exception creating MessageDigest instance for [\" + method + \"]\", e);\n                }\n            });\n            boolean ignoreMissing = readBooleanProperty(TYPE, processorTag, config, \"ignore_missing\", false);\n\n            return new FingerprintProcessor(processorTag, description, fields, targetField, saltBytes, threadLocalHasher, ignoreMissing);\n        }\n    }\n\n    // simple interface around MessageDigest to facilitate testing\n    public interface Hasher {\n\n        void reset();\n\n        void update(byte[] input);\n\n        byte[] digest();\n\n        String getAlgorithm();","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/FingerprintProcessor.java#L242-L278","documentation":"Thrown as IllegalStateException by the FingerprintProcessor.Factory's ThreadLocal initializer when MessageDigest.getInstance(method) cannot find the algorithm on the JVM. The factory has already validated that 'method' is one of SUPPORTED_DIGESTS (MD5, SHA-1, SHA-256, SHA-384, SHA-512), so a NoSuchAlgorithmException here indicates the JVM does not provide one of those algorithms - typically due to a restricted security provider or a stripped/downstream JDK.","triggerScenarios":"Creating/updating a pipeline with a fingerprint processor whose 'method' is valid per SUPPORTED_DIGESTS but unavailable on the running JVM's security providers. This is rare because standard JDKs ship all listed algorithms; it occurs on custom or受限 runtimes.","commonSituations":"Custom JRE builds that omit MD5/SHA-1 from java.security; FIPS-mode JVMs that disable non-approved algorithms; security policy files removing providers; downstream redistributions on embedded devices.","solutions":["Switch the 'method' to an algorithm that is enabled on the JVM (SHA-256 is the most broadly available in restricted modes).","Inspect java.security and the registered Providers (java.security.Provider) to confirm which algorithms are present; restore the SUN provider or BouncyCastle if removed.","Use a non-restricted JDK distribution for the ingest nodes.","If MD5/SHA-1 are explicitly disabled by policy, do not attempt to use them - they are also cryptographically weak."],"exampleFix":"// before - method disabled by FIPS/restricted policy\n{\"fingerprint\": {\"fields\": [\"id\"], \"method\": \"MD5\"}}\n// after\n{\"fingerprint\": {\"fields\": [\"id\"], \"method\": \"SHA-256\"}}","handlingStrategy":"validation","validationCode":"// Pre-validate the algorithm is available before deploying the pipeline (outside ES):\n// java.security.MessageDigest.getInstance(\"SHA-256\");\n// On the JVM, list providers:\n// java.security.Security.getProviders().each { println it }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer SHA-256, which is available on essentially all JDKs including restricted/FIPS modes.","Avoid MD5/SHA-1 - they are disabled on locked-down JVMs and are cryptographically weak.","Audit java.security provider configuration on ingest nodes when running custom distributions."],"tags":["ingest","fingerprint-processor","security-provider","jvm","config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}