{"record":{"id":"c9b70a07ae69dd77","repo":"apache/shenyu","slug":"cannot-resolve-host-host","errorCode":null,"errorMessage":"Cannot resolve host: \" + host","messagePattern":"Cannot resolve host: \" \\+ host","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java","lineNumber":115,"sourceCode":"            throw new IllegalArgumentException(\"Access to sensitive ports is not allowed\");\n        }\n\n        // Additional validation for DNS resolution\n        try {\n            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);\n            for (InetAddress address : addresses) {\n                if (address.isLoopbackAddress() || address.isLinkLocalAddress()\n                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {\n                    throw new IllegalArgumentException(\"Resolved IP address is not allowed: \" + address.getHostAddress());\n                }\n\n                // Check resolved IP against private ranges\n                if (isPrivateIPAddress(address.getHostAddress())) {\n                    throw new IllegalArgumentException(\"Resolved IP address is private: \" + address.getHostAddress());\n                }\n            }\n        } catch (UnknownHostException e) {\n            throw new IllegalArgumentException(\"Cannot resolve host: \" + host);\n        }\n    }\n\n    /**\n     * Check if the host is localhost or localhost variations.\n     *\n     * @param host the host to check\n     * @return true if the host is localhost\n     */\n    private static boolean isLocalhost(final String host) {\n        Set<String> localhostVariations = new HashSet<>(Arrays.asList(\n                \"localhost\", \"127.0.0.1\", \"::1\", \"0.0.0.0\", \"0000:0000:0000:0000:0000:0000:0000:0001\"\n        ));\n        return localhostVariations.contains(host);\n    }\n\n    /**\n     * Check if the host is a private or internal IP address.","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java#L97-L133","documentation":"validateHostForSSRF wraps InetAddress.getAllByName in a try/catch for UnknownHostException and rethrows it as IllegalArgumentException \"Cannot resolve host: <host>\". This means DNS lookup failed — the hostname does not exist, DNS is unreachable, or the name is malformed.","triggerScenarios":"Calling validateUrlForSSRF with a hostname that has no DNS record, a typo'd domain, or while the JVM's DNS resolver cannot reach any nameserver.","commonSituations":"Misconfigured upstream URLs in plugin/divide configuration, offline or air-gapped environments, broken /etc/resolv.conf, or IPv6-only names when DNS lacks AAAA records.","solutions":["Verify the hostname with `nslookup <host>` or `dig <host>` and fix typos.","Check DNS configuration on the host running shenyu-admin (/etc/resolv.conf, nameserver reachability).","Use an IP-based public hostname or ensure the domain's DNS records exist before registering the URL."],"exampleFix":"// before\nUrlSecurityUtils.validateUrlForSSRF(\"http://backen.example.com/api\"); // typo\n// after\nUrlSecurityUtils.validateUrlForSSRF(\"http://backend.example.com/api\");","handlingStrategy":"try-catch","validationCode":"// resolve before validating\nInetAddress.getByName(host); // throws UnknownHostException early if unresolvable","typeGuard":"boolean hostResolvable(String host) {\n    try { InetAddress.getAllByName(host); return true; }\n    catch (UnknownHostException e) { return false; }\n}","tryCatchPattern":"try {\n    UrlSecurityUtils.validateUrlForSSRF(url);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Cannot resolve host\")) {\n        log.error(\"DNS failure for {}: check DNS config/hostname spelling\", url);\n    }\n}","preventionTips":["Verify hostnames with dig/nslookup before configuring them.","Ensure the admin host has working DNS (resolv.conf, nameservers).","Avoid hostnames that only exist in your laptop's hosts file."],"tags":["dns","network","url-validation","hostname"],"backgroundTag":"dns-resolution-failed","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}