{"record":{"id":"ae25bdf245597aaa","repo":"jenkinsci/jenkins","slug":"sha-256-could-not-be-instantiated-but-is-required","errorCode":null,"errorMessage":"SHA-256 could not be instantiated, but is required to be implemented by the language specification","messagePattern":"SHA-256 could not be instantiated, but is required to be implemented by the language specification","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"core/src/main/java/hudson/Util.java","lineNumber":2031,"sourceCode":"     */\n    @Restricted(value = NoExternalUse.class)\n    static boolean GC_AFTER_FAILED_DELETE = SystemProperties.getBoolean(Util.class.getName() + \".performGCOnFailedDelete\");\n\n    private static PathRemover newPathRemover(@NonNull PathRemover.PathChecker pathChecker) {\n        return PathRemover.newFilteredRobustRemover(pathChecker, DELETION_RETRIES, GC_AFTER_FAILED_DELETE, WAIT_BETWEEN_DELETION_RETRIES);\n    }\n\n    /**\n     * Returns SHA-256 Digest of input bytes\n     */\n    @Restricted(NoExternalUse.class)\n    public static byte[] getSHA256DigestOf(@NonNull byte[] input) {\n        try {\n                MessageDigest messageDigest = MessageDigest.getInstance(\"SHA-256\");\n                messageDigest.update(input);\n                return messageDigest.digest();\n        } catch (NoSuchAlgorithmException noSuchAlgorithmException) {\n            throw new IllegalStateException(\"SHA-256 could not be instantiated, but is required to\" +\n                    \" be implemented by the language specification\", noSuchAlgorithmException);\n        }\n    }\n\n    /**\n     * Returns Hex string of SHA-256 Digest of passed input\n     */\n    @Restricted(NoExternalUse.class)\n    public static String getHexOfSHA256DigestOf(byte[] input) {\n        //get hex string of sha 256 of payload\n        byte[] payloadDigest = Util.getSHA256DigestOf(input);\n        return (payloadDigest != null) ? Util.toHexString(payloadDigest) : null;\n    }\n\n\n    /**\n     * Returns Hex string of SHA-256 Digest of passed string\n     */","sourceCodeStart":2013,"sourceCodeEnd":2049,"githubUrl":"https://github.com/jenkinsci/jenkins/blob/2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc/core/src/main/java/hudson/Util.java#L2013-L2049","documentation":"Wraps NoSuchAlgorithmException when MessageDigest.getInstance(\"SHA-256\") fails. Per the Java specification (JCA reference guide), SHA-256 is a mandatory algorithm that every compliant JVM must provide, so this exception indicates a fundamentally broken JVM environment rather than a normal runtime condition.","triggerScenarios":"MessageDigest.getInstance(\"SHA-256\") throws NoSuchAlgorithmException — the JVM's security provider list does not include an implementation of SHA-256. This is only possible with a custom or severely stripped JVM, a misconfigured security provider list (e.g., java.security file with all providers removed), or a FIPS-mode configuration that fails to register a SHA-256 provider.","commonSituations":"Custom JRE build with stripped JCA providers; java.security file modified to remove the default Sun provider; FIPS-compliant JVM configured incorrectly where the BouncyCastle FIPS provider is not properly registered; running on an embedded JVM that doesn't implement the full JCA specification.","solutions":["Verify the JVM is a standard OpenJDK or Oracle JDK distribution — a full JDK always includes SHA-256.","Check java.security file (in $JAVA_HOME/conf/security/java.security) to ensure the default Sun (or SunRsaSign/SunEC) provider is listed.","If using a FIPS provider (e.g., BouncyCastle FIPS), ensure it is correctly registered in java.security and its JAR is on the classpath."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Verify SHA-256 availability at startup\ntry {\n    MessageDigest.getInstance(\"SHA-256\");\n} catch (NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"JVM does not provide SHA-256 — check java.security providers\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    byte[] digest = Util.getSHA256DigestOf(input);\n} catch (IllegalStateException e) {\n    // This should never happen on a compliant JVM\n    // Fall back to an alternative provider or fail hard\n    throw new ServletException(\"Critical JVM misconfiguration: SHA-256 unavailable\", e);\n}","preventionTips":["Use a standard JDK distribution (OpenJDK, Oracle JDK) rather than stripped JVMs.","Do not modify java.security to remove default JCA providers.","If using FIPS mode, validate the security provider registration during deployment testing."],"tags":["security","crypto","jvm","sha256","provider"],"backgroundTag":null,"analyzedSha":"2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc","analyzedAt":"2026-08-14T07:07:15.274Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}