{"record":{"id":"8b9a61763ff7150c","repo":"apache/cassandra","slug":"invalid-ttl-s","errorCode":null,"errorMessage":"Invalid TTL: %s","messagePattern":"Invalid TTL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/rows/Cell.java","lineNumber":418,"sourceCode":"            V value = accessor.empty();\n            if (hasValue)\n            {\n                if (helper.canSkipValue(column) || (path != null && helper.canSkipValue(path)))\n                {\n                    header.getType(column).skipValue(in);\n                }\n                else\n                {\n                    boolean isCounter = localDeletionTime == NO_DELETION_TIME && column.type.isCounter();\n\n                    value = header.getType(column).read(accessor, in, DatabaseDescriptor.getMaxValueSize());\n                    if (isCounter)\n                        value = helper.maybeClearCounterValue(value, accessor);\n                }\n            }\n\n            if (ttl < 0)\n                throw new IOException(\"Invalid TTL: \" + ttl);\n            localDeletionTime = decodeLocalDeletionTime(localDeletionTime, ttl, helper);\n            return accessor.factory().cell(column, timestamp, ttl, localDeletionTime, value, path);\n        }\n\n        public <T> long serializedSize(Cell<T> cell, ColumnMetadata column, LivenessInfo rowLiveness, SerializationHeader header)\n        {\n            long size = 1; // flags\n            boolean hasValue = cell.valueSize() > 0;\n            boolean isDeleted = cell.isTombstone();\n            boolean isExpiring = cell.isExpiring();\n            boolean useRowTimestamp = !rowLiveness.isEmpty() && cell.timestamp() == rowLiveness.timestamp();\n            boolean useRowTTL = isExpiring && rowLiveness.isExpiring() && cell.ttl() == rowLiveness.ttl() && cell.localDeletionTime() == rowLiveness.localExpirationTime();\n\n            if (!useRowTimestamp)\n                size += header.timestampSerializedSize(cell.timestamp());\n\n            if ((isDeleted || isExpiring) && !useRowTTL)\n                size += header.localDeletionTimeSerializedSize(cell.localDeletionTime());","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/rows/Cell.java#L400-L436","documentation":"While deserializing a cell from the wire (or an SSTable via the same code path), Cell.Serializer reads the TTL field. A negative TTL is not representable in the object model and can only come from a corrupt or maliciously crafted payload, so deserialization fails immediately with an IOException, aborting the read of that message/partition.","triggerScenarios":"Receiving a mutated/corrupted internode message whose cell TTL field is negative; reading a corrupt SSTable region interpreted as TTL bytes; version-skew or deserialization of an attacker-crafted payload.","commonSituations":"Network corruption or buffer handling bugs; corrupted commitlog/SSTable files; fuzzing or crafted streaming payloads between nodes.","solutions":["Identify and drop/scrub the corrupt data source (`nodetool scrub` for SSTables, replay-truncate commitlog if needed).","Verify internode network integrity (NIC/driver issues) if corruption appears in transit.","Ensure node versions are compatible (same messaging version) to avoid misparsed fields.","Restore affected data from backups."],"exampleFix":"// before: writing TTL into a payload without bounds check\nout.writeInt((int) ttlOrOverride);\n// after\nint ttl = (int) ttlOrOverride;\nif (ttl < 0) throw new IllegalArgumentException(\"TTL must be >= 0\");\nout.writeInt(ttl);","handlingStrategy":"try-catch","validationCode":"// validate before sending: reject negative TTLs at write time\nif (ttl < 0) throw new IllegalArgumentException(\"Invalid TTL: \" + ttl);","typeGuard":null,"tryCatchPattern":"try { Cell.codec.deserialize(in, version, column, ...); } catch (IOException e) { markSourceCorrupt(e); }","preventionTips":["Keep node messaging versions homogeneous in the cluster","Scrub after hardware faults","Reject negative TTLs in application writes"],"tags":["deserialization","ttl","data-corruption","wire-protocol"],"backgroundTag":"value-out-of-range","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}