{"record":{"id":"b7d51e47c3eacda4","repo":"spring-projects/spring-security","slug":"iterations-value-must-be-greater-than-zero","errorCode":null,"errorMessage":"Iterations value must be greater than zero","messagePattern":"Iterations value must be greater than zero","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/Digester.java","lineNumber":59,"sourceCode":"\t */\n\tDigester(String algorithm, int iterations) {\n\t\t// eagerly validate the algorithm\n\t\tcreateDigest(algorithm);\n\t\tthis.algorithm = algorithm;\n\t\tsetIterations(iterations);\n\t}\n\n\tbyte[] digest(byte[] value) {\n\t\tMessageDigest messageDigest = createDigest(this.algorithm);\n\t\tfor (int i = 0; i < this.iterations; i++) {\n\t\t\tvalue = messageDigest.digest(value);\n\t\t}\n\t\treturn value;\n\t}\n\n\tvoid setIterations(int iterations) {\n\t\tif (iterations <= 0) {\n\t\t\tthrow new IllegalArgumentException(\"Iterations value must be greater than zero\");\n\t\t}\n\t\tthis.iterations = iterations;\n\t}\n\n\tprivate static MessageDigest createDigest(String algorithm) {\n\t\ttry {\n\t\t\treturn MessageDigest.getInstance(algorithm);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(\"No such hashing algorithm\", ex);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":41,"sourceCodeEnd":74,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/Digester.java#L41-L74","documentation":"Digester.setIterations throws this IllegalArgumentException when the configured iteration count is zero or negative. Spring Security's Digester performs hash-derived key stretching by repeatedly applying a MessageDigest, so a non-positive iteration count is meaningless and would silently weaken or break hashing. The library fails fast at configuration time rather than producing unusable digests.","triggerScenarios":"Calling setIterations(0) or setIterations(negative) on a Digester instance, or constructing a password encoder that forwards a non-positive iterations value into Digester.","commonSituations":"Loading an iteration count from external configuration (properties, YAML, environment) that is unset (0) or a mis-parsed negative value; a refactor or test that mistakenly disables iterations by setting them to 0.","solutions":["Pass a strictly positive iteration count (e.g. setIterations(1024) or higher per your security requirements).","Clamp or validate any externally supplied value before calling setIterations: if (iterations > 0) digester.setIterations(iterations);","Check the configuration source for a missing/unset property defaulting to 0 and set a sane default."],"exampleFix":"// before\ndigester.setIterations(config.getIterations()); // 0 when property missing\n// after\nint iterations = Math.max(config.getIterations(), 1024);\ndigester.setIterations(iterations);","handlingStrategy":"validation","validationCode":"if (iterations <= 0) throw new IllegalArgumentException(\"iterations must be > 0\");\ndigester.setIterations(iterations);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default iteration counts in config loaders (e.g. 1024) so missing properties never yield 0.","Parse iteration counts with explicit bounds checking at the configuration boundary."],"tags":["java","spring-security","crypto","configuration"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}