{"record":{"id":"8b9b61bd4d960df3","repo":"apache/cassandra","slug":"failed-to-decode-given-base64-input-msg","errorCode":null,"errorMessage":"Failed to decode given base64 input. msg=","messagePattern":"Failed to decode given base64 input\\. msg=","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMReader.java","lineNumber":282,"sourceCode":"        return certificateList;\n    }\n\n    /**\n     * Decodes given input in Base64 format.\n     *\n     * @param base64Input input to be decoded\n     * @return byte[] containing decoded bytes\n     * @throws GeneralSecurityException in case it fails to decode the given base64 input\n     */\n    private static byte[] decodeBase64(String base64Input) throws GeneralSecurityException\n    {\n        try\n        {\n            return Base64.getDecoder().decode(base64Input);\n        }\n        catch (IllegalArgumentException e)\n        {\n            throw new GeneralSecurityException(\"Failed to decode given base64 input. msg=\" + e.getMessage(), e);\n        }\n    }\n}\n","sourceCodeStart":264,"sourceCodeEnd":286,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMReader.java#L264-L286","documentation":"decodeBase64 wraps the JDK strict Base64 decoder; when the extracted base64 payload between the PEM BEGIN/END markers contains illegal characters (anything outside A-Z, a-z, 0-9, +, /, = after whitespace is stripped), IllegalArgumentException is rethrown as this GeneralSecurityException. It means the body of the PEM block is not valid base64.","triggerScenarios":"Calling PEMReader.extractPrivateKey or extractCertificates where the base64 body of the PEM block contains characters the strict decoder rejects — e.g. headers like 'Proc-Type: 4,ENCRYPTED' left inside the block, base64 with url-safe characters (-, _) instead of standard (+, /), embedded comments, or non-ASCII characters introduced by copy/paste or encoding conversion.","commonSituations":"Copy-pasting keys from a web page or terminal that introduced smart quotes or hidden characters; YAML folding mangling the base64 body; a legacy encrypted PEM whose 'Proc-Type'/'DEK-Info' headers were not stripped before the base64 region; a key encoded in base64url or SSH format rather than standard PEM base64.","solutions":["Inspect the base64 body for illegal characters (smart quotes, non-ASCII, 'Proc-Type'/'DEK-Info' headers) and regenerate/re-export the PEM file cleanly","Re-export the key/certificate from the source keystore rather than copy/pasting content","Check line encoding — rewrite the file with Unix line endings (dos2unix) if it came from Windows","Enable debug logging on PEMReader and decode the extracted base64 manually to locate the offending character","If headers exist above the key body (traditional encrypted format), convert to PKCS#8: openssl pkcs8 -topk8"],"exampleFix":"# before: traditional encrypted PEM with headers inside the block\n-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info: DES-EDE3-CBC,...\n...\n# after: convert to PKCS#8 PEM\nopenssl pkcs8 -topk8 -in trad-key.pem -out cassandra-pkcs8.key","handlingStrategy":"validation","validationCode":"// Validate the PEM body is strict base64 before calling the API\nstatic boolean isValidPemBase64(String pem) {\n    java.util.regex.Matcher m = java.util.regex.Pattern.compile(\n        \"-+BEGIN\\\\s+.*PRIVATE\\\\s+KEY[^-]*-+(?:\\\\s|\\\\r|\\\\n)+([a-z0-9+/=\\\\r\\\\n]+)-+END\", java.util.regex.Pattern.CASE_INSENSITIVE)\n        .matcher(pem);\n    if (!m.find()) return false;\n    try { java.util.Base64.getDecoder().decode(m.group(1).replaceAll(\"\\\\s\", \"\")); return true; }\n    catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n    Certificate[] certs = PEMReader.extractCertificates(pemCerts);\n} catch (GeneralSecurityException e) {\n    if (e.getMessage().startsWith(\"Failed to decode given base64 input\")) {\n        logger.error(\"PEM body contains non-base64 characters - re-export the key/cert cleanly (check encoding, headers, copy/paste artifacts)\", e);\n    }\n    throw e;\n}","preventionTips":["Re-export PEM files from the source keystore instead of copy/pasting through editors or chat tools","Normalize files to ASCII/UTF-8 without BOM and Unix line endings (dos2unix)","Convert legacy traditional-format keys (with Proc-Type/DEK-Info headers) to PKCS#8 PEM","Validate with 'openssl pkey' / 'openssl x509' locally before deploying the file"],"tags":["security","pem","base64","encoding"],"backgroundTag":"invalid-argument-format","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}