{"record":{"id":"b246f50a1561bc98","repo":"spring-projects/spring-security","slug":"invalid-iterations-parameter","errorCode":null,"errorMessage":"Invalid iterations parameter","messagePattern":"Invalid iterations parameter","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java","lineNumber":129,"sourceCode":"\t\t\tcase \"argon2d\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_d);\n\t\t\tcase \"argon2i\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_i);\n\t\t\tcase \"argon2id\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);\n\t\t\tdefault -> throw new IllegalArgumentException(\"Invalid algorithm type: \" + parts[1]);\n\t\t};\n\t\tif (parts[currentPart].startsWith(\"v=\")) {\n\t\t\tparamsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));\n\t\t\tcurrentPart++;\n\t\t}\n\t\tString[] performanceParams = parts[currentPart++].split(\",\");\n\t\tif (performanceParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\t\tif (!performanceParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tparamsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));\n\t\tif (!performanceParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tparamsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));\n\t\tif (!performanceParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallelity parameter\");\n\t\t}\n\t\tparamsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));\n\t\tparamsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));\n\t\treturn new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());\n\t}\n\n\tpublic static class Argon2Hash {\n\n\t\tprivate byte[] hash;\n\n\t\tprivate Argon2Parameters parameters;\n\n\t\tArgon2Hash(byte[] hash, Argon2Parameters parameters) {\n\t\t\tthis.hash = Arrays.clone(hash);","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java#L111-L147","documentation":"The second performance parameter must start with 't=' (iteration count). If performanceParams[1] does not, decode() throws this IllegalArgumentException. The iteration count is required to reconstruct the Argon2Parameters for verification.","triggerScenarios":"Calling decode() on a hash whose second comma-separated parameter lacks 't=' — e.g. 'm=65536,3,p=1' (missing the t= key) or fields out of order.","commonSituations":"Hashes from custom or buggy Argon2 encoders; hand-edited hashes where 't=' was deleted; format conversions between hash notations.","solutions":["Restore the canonical parameter form 'm=<kb>,t=<it>,p=<par>' in the hash string","Regenerate the hash with a spec-compliant encoder such as Argon2PasswordEncoder","Add a pre-decode regex validation to fail fast with a clearer message"],"exampleFix":"// before\nString params = \"m=65536,3,p=1\";\n// after\nString params = \"m=65536,t=3,p=1\";","handlingStrategy":"validation","validationCode":"static boolean hasIterationsParam(String encodedHash) {\n    String[] parts = encodedHash.split(\"\\\\$\");\n    return parts.length >= 3 && parts[2].matches(\".*\\\\bt=\\\\d+.*\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return Argon2EncodingUtils.decode(hash);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Argon2 hash missing t= iterations parameter\");\n    return false;\n}","preventionTips":["Validate the parameter segment against 'm=\\\\d+,t=\\\\d+,p=\\\\d+' before decode","Reject hashes from custom encoders that do not emit the PHC parameter keys","Force password reset for records with malformed parameters"],"tags":["argon2","password-hashing","input-validation","java","spring-security"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}