{"record":{"id":"996ab71a5823cb50","repo":"flowable/flowable-engine","slug":"md5-algorithm-not-available-fatal-should-be-in-t","errorCode":null,"errorMessage":"MD5 algorithm not available. Fatal (should be in the JDK).","messagePattern":"MD5 algorithm not available\\. Fatal \\(should be in the JDK\\)\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"modules/flowable-event-registry/src/main/java/org/flowable/eventregistry/impl/DefaultCorrelationKeyGenerator.java","lineNumber":52,"sourceCode":" */\npublic class DefaultCorrelationKeyGenerator implements CorrelationKeyGenerator<Map<String, Object>> {\n\n    @Override\n    public String generateKey(Map<String, Object> source) {\n        StringBuilder sb = new StringBuilder();\n        List<String> keys = new ArrayList<>(source.keySet());\n        Collections.sort(keys);\n        for (String key : keys) {\n            Object sourceValue = source.get(key);\n            String value = sourceValue == null ? \"\" : sourceValue.toString();\n            sb.append(key).append(\"=\").append(value).append(\";\");\n        }\n\n        MessageDigest digest;\n        try {\n            digest = MessageDigest.getInstance(\"MD5\");\n        } catch (NoSuchAlgorithmException e) {\n            throw new IllegalStateException(\"MD5 algorithm not available. Fatal (should be in the JDK).\");\n        }\n\n        byte[] bytes = digest.digest(sb.toString().getBytes(StandardCharsets.UTF_8));\n        return String.format(\"%x\", new BigInteger(1, bytes));\n    }\n}\n","sourceCodeStart":34,"sourceCodeEnd":59,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-event-registry/src/main/java/org/flowable/eventregistry/impl/DefaultCorrelationKeyGenerator.java#L34-L59","documentation":"DefaultCorrelationKeyGenerator.generateKey() hashes the built correlation string with MD5 and wraps MessageDigest.getInstance(\"MD5\") in an IllegalStateException if the JCE reports NoSuchAlgorithmException. This should be impossible on a compliant JDK, since MD5 is mandated by the platform spec; it indicates a broken or deliberately stripped JCE/Java installation.","triggerScenarios":"Correlation key generation (event correlation on a correlated event) on a JVM whose security provider list excludes MD5 — e.g. a custom JRE with crypto providers removed, hardened java.security settings, or a malformed classpath/limited export policy (historical JCE restrictions).","commonSituations":"Custom minimal/embedded JREs without crypto providers; java.security files that removed or blocked MD5 for compliance; broken JDK installs; unusual FIPS-only environments.","solutions":["Run on a standard, complete JDK/JRE where MD5 is available","Inspect java.security and restore/re-add the provider offering MD5 (e.g. SUN via security.provider.N=... or Security.addProvider)","If MD5 must be blocked for compliance, subclass/replace the CorrelationKeyGenerator with a SHA-256-based implementation and register it on the event registry configuration"],"exampleFix":"// before\nEventRegistryConfiguration config = ...; // default DefaultCorrelationKeyGenerator, FIPS JVM throws\n// after\nconfig.setCorrelationKeyGenerator(new Sha256CorrelationKeyGenerator()); // custom generator using SHA-256","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"catch (IllegalStateException e) { /* MD5 unavailable: fail with actionable JVM/provider guidance */ }","preventionTips":["Audit JVM crypto providers after environment changes"],"tags":["crypto","md5","jdk","environment","correlation-key"],"backgroundTag":"internal-invariant-violation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}