{"record":{"id":"e22a40252f2abdbd","repo":"hashicorp/nomad","slug":"invalid-character-in-cni-arg-key-q","errorCode":null,"errorMessage":"invalid ';' character in CNI arg key %q","messagePattern":"invalid ';' character in CNI arg key %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":7395,"sourceCode":"\t\t\t}\n\t\t}\n\t\t// Validate the cniArgs in each network resource. Make sure there are no duplicate Args in\n\t\t// different network resources or invalid characters (;) in key or value ;)\n\t\tif net.CNI != nil {\n\t\t\tfor k, v := range net.CNI.Args {\n\t\t\t\tif cniArgKeys.Contains(k) {\n\t\t\t\t\terr := fmt.Errorf(\"duplicate CNI arg %q\", k)\n\t\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t\t} else {\n\t\t\t\t\tcniArgKeys.Insert(k)\n\t\t\t\t}\n\t\t\t\t// CNI_ARGS is a \";\"-separated string of \"key=val\", so a \";\"\n\t\t\t\t// in either key or val would confuse plugins (or libraries)\n\t\t\t\t// that parse that string.\n\t\t\t\t// Pre-validating this here protects job authors from submitting\n\t\t\t\t// a job that will most likely error later on the client anyway.\n\t\t\t\tif strings.Contains(k, \";\") {\n\t\t\t\t\terr := fmt.Errorf(\"invalid ';' character in CNI arg key %q\", k)\n\t\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t\t}\n\t\t\t\tif strings.Contains(v, \";\") {\n\t\t\t\t\terr := fmt.Errorf(\"invalid ';' character in CNI arg value %q\", v)\n\t\t\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Validate the hostname field to be a valid DNS name. If the parameter\n\t\t// looks like it includes an interpolation value, we skip this. It\n\t\t// would be nice to validate additional parameters, but this isn't the\n\t\t// right place.\n\t\tif net.Hostname != \"\" && !strings.Contains(net.Hostname, \"${\") {\n\t\t\tif _, ok := dns.IsDomainName(net.Hostname); !ok {\n\t\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Hostname is not a valid DNS name\"))\n\t\t\t}\n\t\t}","sourceCodeStart":7377,"sourceCodeEnd":7413,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L7377-L7413","documentation":"Validation guard in job network validation: CNI_ARGS is a ';'-separated key=val string, so a ';' embedded in an argument key would break parsing by CNI plugins or libraries. The key named in the message contains that forbidden character.","triggerScenarios":"Thrown at nomad/structs/structs.go:7395 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the ';' character from the CNI arg key","Replace the ';' with a safe delimiter such as '-' or '_'"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}