{"record":{"id":"e1b92928397ce425","repo":"TooTallNate/Java-WebSocket","slug":"invalid-ssl-status","errorCode":null,"errorMessage":"Invalid SSL status: ","messagePattern":"Invalid SSL status: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/SSLSocketChannel.java","lineNumber":197,"sourceCode":"          log.error(\"SSLException during unwrap\", e);\n          throw e;\n        }\n        switch (result.getStatus()) {\n          case OK:\n            peerAppData.flip();\n            return ByteBufferUtils.transferByteBuffer(peerAppData, dst);\n          case BUFFER_UNDERFLOW:\n            peerAppData.flip();\n            return ByteBufferUtils.transferByteBuffer(peerAppData, dst);\n          case BUFFER_OVERFLOW:\n            peerAppData = enlargeApplicationBuffer(peerAppData);\n            return read(dst);\n          case CLOSED:\n            closeConnection();\n            dst.clear();\n            return -1;\n          default:\n            throw new IllegalStateException(\"Invalid SSL status: \" + result.getStatus());\n        }\n      }\n    } else if (bytesRead < 0) {\n      handleEndOfStream();\n    }\n    ByteBufferUtils.transferByteBuffer(peerAppData, dst);\n    return bytesRead;\n  }\n\n  @Override\n  public synchronized int write(ByteBuffer output) throws IOException {\n    int num = 0;\n    while (output.hasRemaining()) {\n      // The loop has a meaning for (outgoing) messages larger than 16KB.\n      // Every wrap call will remove 16KB from the original message and send it to the remote peer.\n      myNetData.clear();\n      SSLEngineResult result = engine.wrap(output, myNetData);\n      switch (result.getStatus()) {","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/SSLSocketChannel.java#L179-L215","documentation":"In SSLSocketChannel.read(), after unwrap() the SSLEngine result status can be OK, CLOSED, BUFFER_UNDERFLOW or BUFFER_OVERFLOW; only the first two are handled. Any other status (or an unexpected Status value) reaches the default branch and throws IllegalStateException('Invalid SSL status: ' + result.getStatus()).","triggerScenarios":"unwrap() during read returns Status.BUFFER_OVERFLOW/BUFFER_UNDERFLOW or a non-standard status that the switch does not cover.","commonSituations":"Peer sends TLS records larger than the allocated peerNetData buffer (underflow path mishandled) or application buffers sized smaller than the negotiated session's application-buffer size.","solutions":["Allocate app/net buffers via engine.getSession().getApplicationBufferSize()/getPacketBufferSize() (or the library's enlargeBuffer helpers)","Catch IllegalStateException, resize peerNetData/peerAppData and retry the unwrap","Upgrade the library to a version that handles all SSLEngineResult.Status values in read()"],"exampleFix":"// before\nswitch (result.getStatus()) { case OK: ...; case CLOSED: ...; default: throw ...; }\n// after\nif (result.getStatus() == SSLEngineResult.Status.BUFFER_UNDERFLOW) {\n  peerNetData = enlargeInboundBuffer(peerNetData); // then retry unwrap\n}\nif (result.getStatus() == SSLEngineResult.Status.BUFFER_OVERFLOW) {\n  peerAppData = enlargeApplicationBuffer(peerAppData); // then retry unwrap\n}","handlingStrategy":"try-catch","validationCode":"int pkt = engine.getSession().getPacketBufferSize();\nint app = engine.getSession().getApplicationBufferSize();\n// ensure peerNetData.capacity() >= pkt and peerAppData.capacity() >= app before reading","typeGuard":null,"tryCatchPattern":"try { channel.read(dst); } catch (IllegalStateException e) { log.warn(\"Unexpected SSL status during read: {}\", e.getMessage()); channel.closeConnection(); }","preventionTips":["Size read buffers from engine.getSession() capacities, with room to grow","Keep the library and JDK updated so all SSLEngineResult.Status values are handled"],"tags":["websocket","ssl","illegal-state","tls-handshake"],"backgroundTag":"internal-invariant-violation","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}