{"record":{"id":"8a13c90352671003","repo":"spring-projects/spring-security","slug":"invalid-parallelity-parameter","errorCode":null,"errorMessage":"Invalid parallelity parameter","messagePattern":"Invalid parallelity parameter","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java","lineNumber":133,"sourceCode":"\t\t};\n\t\tif (parts[currentPart].startsWith(\"v=\")) {\n\t\t\tparamsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));\n\t\t\tcurrentPart++;\n\t\t}\n\t\tString[] performanceParams = parts[currentPart++].split(\",\");\n\t\tif (performanceParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\t\tif (!performanceParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tparamsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));\n\t\tif (!performanceParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tparamsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));\n\t\tif (!performanceParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallelity parameter\");\n\t\t}\n\t\tparamsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));\n\t\tparamsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));\n\t\treturn new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());\n\t}\n\n\tpublic static class Argon2Hash {\n\n\t\tprivate byte[] hash;\n\n\t\tprivate Argon2Parameters parameters;\n\n\t\tArgon2Hash(byte[] hash, Argon2Parameters parameters) {\n\t\t\tthis.hash = Arrays.clone(hash);\n\t\t\tthis.parameters = parameters;\n\t\t}\n\n\t\tpublic byte[] getHash() {","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java#L115-L151","documentation":"The third performance parameter must start with 'p=' (parallelism/lane count). If performanceParams[2] does not, decode() throws this IllegalArgumentException. Parallelism is needed to fully rebuild Argon2Parameters; without it the hash cannot be verified.","triggerScenarios":"Calling decode() on a hash whose third comma-separated parameter lacks 'p=' — e.g. 'm=65536,t=3,1' or a truncated parameter segment ending at 't=3'.","commonSituations":"Truncated copy/paste of hash strings; custom encoders omitting the parallelism field; hashes migrated between systems with lossy string handling.","solutions":["Complete the parameter segment to 'm=<kb>,t=<it>,p=<par>' with a valid parallelism value (typically 1)","Regenerate the hash with Argon2PasswordEncoder and update the stored value","Validate the full PHC pattern with a regex before calling decode()"],"exampleFix":"// before\nString hash = \"$argon2id$v=19$m=65536,t=3$salt$hash\"; // p= missing\n// after\nString hash = \"$argon2id$v=19$m=65536,t=3,p=1$salt$hash\";","handlingStrategy":"validation","validationCode":"static boolean hasParallelismParam(String encodedHash) {\n    String[] parts = encodedHash.split(\"\\\\$\");\n    return parts.length >= 3 && parts[2].matches(\"m=\\\\d+,t=\\\\d+,p=\\\\d+\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return Argon2EncodingUtils.decode(hash);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Argon2 hash missing p= parallelism parameter\");\n    return false;\n}","preventionTips":["Verify hashes end with all four segments (algo, params, salt, hash) before storing","Guard copy/paste workflows with a length/shape check","Re-encode rather than patching parameter segments by hand"],"tags":["argon2","password-hashing","input-validation","java","spring-security"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}