{"record":{"id":"c46d742b52ca5c5c","repo":"apache/cassandra","slug":"denylist-max-keys-total-must-be-a-positive-integer","errorCode":null,"errorMessage":"denylist_max_keys_total must be a positive integer.","messagePattern":"denylist_max_keys_total must be a positive integer\\.","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":5584,"sourceCode":"        return conf.denylist_max_keys_per_table;\n    }\n\n    public static void setDenylistMaxKeysPerTable(int value)\n    {\n        if (value <= 0)\n            throw new IllegalArgumentException(\"denylist_max_keys_per_table must be a positive integer.\");\n        conf.denylist_max_keys_per_table = value;\n    }\n\n    public static int getDenylistMaxKeysTotal()\n    {\n        return conf.denylist_max_keys_total;\n    }\n\n    public static void setDenylistMaxKeysTotal(int value)\n    {\n        if (value <= 0)\n            throw new IllegalArgumentException(\"denylist_max_keys_total must be a positive integer.\");\n        conf.denylist_max_keys_total = value;\n    }\n\n    public static boolean getAuthCacheWarmingEnabled()\n    {\n        return conf.auth_cache_warming_enabled;\n    }\n\n    public static SubnetGroups getClientErrorReportingExclusions()\n    {\n        return conf.client_error_reporting_exclusions;\n    }\n\n    public static SubnetGroups getInternodeErrorReportingExclusions()\n    {\n        return conf.internode_error_reporting_exclusions;\n    }\n","sourceCodeStart":5566,"sourceCodeEnd":5602,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L5566-L5602","documentation":"DatabaseDescriptor.setDenylistMaxKeysTotal enforces that the cluster-wide denylist key limit is a positive integer. Zero or negative totals would break denylist accounting across tables, so the setter throws IllegalArgumentException before mutating conf.","triggerScenarios":"Calling DatabaseDescriptor.setDenylistMaxKeysTotal(0) or a negative value, programmatically or via a live-config update path.","commonSituations":"Operators use 0 to mean 'no limit'; automated config generators emit unset/zero numeric fields; arithmetic on existing limits produces 0 or negatives.","solutions":["Pass a positive integer (>= 1) to setDenylistMaxKeysTotal.","Correct the denylist_max_keys_total value in cassandra.yaml and reload.","Use the denylist enable/disable option rather than a zero total to turn the feature off."],"exampleFix":"// before\nDatabaseDescriptor.setDenylistMaxKeysTotal(-5);\n// after\nDatabaseDescriptor.setDenylistMaxKeysTotal(5000);","handlingStrategy":"validation","validationCode":"if (value >= 1) DatabaseDescriptor.setDenylistMaxKeysTotal(value);","typeGuard":"boolean isValidDenylistTotal(int v) { return v > 0; }","tryCatchPattern":"try { DatabaseDescriptor.setDenylistMaxKeysTotal(value); } catch (IllegalArgumentException e) { log.error(\"bad denylist_max_keys_total\", e); }","preventionTips":["Use the enable/disable flag for turning denylisting off.","Sanity-check config generators' numeric output.","Document that 0 is not a valid 'unlimited' sentinel."],"tags":["configuration","validation","illegal-argument"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}