{"record":{"id":"b6e2f769cf8d6e89","repo":"hashicorp/terraform","slug":"invalid-cidr-expression-s","errorCode":null,"errorMessage":"invalid CIDR expression: %s","messagePattern":"invalid CIDR expression: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/lang/funcs/cidr.go","lineNumber":40,"sourceCode":"\t\t{\n\t\t\tName: \"prefix\",\n\t\t\tType: cty.String,\n\t\t},\n\t\t{\n\t\t\tName: \"hostnum\",\n\t\t\tType: cty.Number,\n\t\t},\n\t},\n\tType:         function.StaticReturnType(cty.String),\n\tRefineResult: refineNotNull,\n\tImpl: func(args []cty.Value, retType cty.Type) (ret cty.Value, err error) {\n\t\tvar hostNum *big.Int\n\t\tif err := gocty.FromCtyValue(args[1], &hostNum); err != nil {\n\t\t\treturn cty.UnknownVal(cty.String), err\n\t\t}\n\t\t_, network, err := ipaddr.ParseCIDR(args[0].AsString())\n\t\tif err != nil {\n\t\t\treturn cty.UnknownVal(cty.String), fmt.Errorf(\"invalid CIDR expression: %s\", err)\n\t\t}\n\n\t\tip, err := cidr.HostBig(network, hostNum)\n\t\tif err != nil {\n\t\t\treturn cty.UnknownVal(cty.String), err\n\t\t}\n\n\t\treturn cty.StringVal(ip.String()), nil\n\t},\n})\n\n// CidrNetmaskFunc contructs a function that converts an IPv4 address prefix given\n// in CIDR notation into a subnet mask address.\nvar CidrNetmaskFunc = function.New(&function.Spec{\n\tParams: []function.Parameter{\n\t\t{\n\t\t\tName: \"prefix\",\n\t\t\tType: cty.String,","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/lang/funcs/cidr.go#L22-L58","documentation":"Returned by the cidrhost built-in (CidrHostFunc, internal/lang/funcs/cidr.go:40) when ipaddr.ParseCIDR(args[0].AsString()) fails for the prefix argument. ParseCIDR requires true CIDR notation (address/prefixlen, e.g. 10.0.0.0/16); a bare IP, a host with a host portion set, or a malformed string all fail and the error is surfaced verbatim as the second %s.","triggerScenarios":"Calling cidrhost(prefix, hostnum) where prefix is not valid CIDR: missing /mask (e.g. \"10.0.0.0\"), host bits set in what should be a network (some parsers reject), invalid octets, or a non-IP string. The function then returns cty.UnknownVal(String) plus this error.","commonSituations":"Forgetting the /mask in cidrhost(\"10.0.0.0\", 5), passing a variable that is null/empty at evaluate time, a computed CIDR that resolves to a bare IP, IPv4/IPv6 formatting mistakes, or copy-paste of a gateway IP instead of a network prefix.","solutions":["Provide the prefix with an explicit mask: cidrhost(\"10.0.0.0/16\", 5).","If the prefix is computed, ensure it always carries a /mask before being passed to cidrhost.","Guard null/unknown: only call cidrhost when the prefix var is known and non-empty.","Use cidrsubnet/cidrsubnets to derive valid network prefixes from a base CIDR."],"exampleFix":"# before (HCL)\noutput \"ip\" {\n  value = cidrhost(var.base_cidr, 5)\n}\n# var.base_cidr = \"10.0.0.0\" (no mask) -> invalid CIDR expression\n\n# after\noutput \"ip\" {\n  value = cidrhost(\"10.0.0.0/16\", 5)\n}\n# or guard:\noutput \"ip\" {\n  value = var.base_cidr != \"\" ? cidrhost(var.base_cidr, 5) : null\n}","handlingStrategy":"validation","validationCode":"# (HCL) guard before calling cidrhost\noutput \"ip\" {\n  value = var.cidr != \"\" && can(regex(\"/.+\", var.cidr)) ? cidrhost(var.cidr, 5) : null\n}","typeGuard":"// (Go) true if the string is parseable as CIDR\nfunc isValidCIDR(s string) bool {\n    _, _, err := net.ParseCIDR(s)\n    return err == nil\n}","tryCatchPattern":"# (HCL) use try to fall back gracefully\nvalue = try(cidrhost(var.cidr, 5), null)","preventionTips":["Always include the /mask in cidrhost prefixes.","Guard empty/null computed prefixes with a conditional.","Derive prefixes from a validated base CIDR via cidrsubnet.","Use can()/try() to degrade gracefully on bad input."],"tags":["cidr","network","ip","hcl-function","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}