{"record":{"id":"e51639a67d93bcc8","repo":"apache/cassandra","slug":"bad-value-for-system-property-d-s-please-use-a-va","errorCode":null,"errorMessage":"Bad value for system property -D%s.Please use a value between 4 and 30 inclusively","messagePattern":"Bad value for system property -D(.+?)\\.Please use a value between 4 and 30 inclusively","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordSaltSupplier.java","lineNumber":41,"sourceCode":"import com.google.common.annotations.VisibleForTesting;\n\nimport org.mindrot.jbcrypt.BCrypt;\n\nimport org.apache.cassandra.exceptions.ConfigurationException;\n\nimport static org.apache.cassandra.config.CassandraRelevantProperties.AUTH_BCRYPT_GENSALT_LOG2_ROUNDS;\n\npublic class PasswordSaltSupplier\n{\n    // 2 ** GENSALT_LOG2_ROUNDS rounds of hashing will be performed.\n    private static final int GENSALT_LOG2_ROUNDS = getGensaltLogRounds();\n\n    @VisibleForTesting\n    static int getGensaltLogRounds()\n    {\n        int rounds = AUTH_BCRYPT_GENSALT_LOG2_ROUNDS.getInt();\n        if (rounds < 4 || rounds > 30)\n            throw new ConfigurationException(String.format(\"Bad value for system property -D%s.\" +\n                                                           \"Please use a value between 4 and 30 inclusively\",\n                                                           AUTH_BCRYPT_GENSALT_LOG2_ROUNDS.getKey()));\n        return rounds;\n    }\n    private static Supplier<String> DEFAULT_SALT_SUPPLIER = () -> BCrypt.gensalt(GENSALT_LOG2_ROUNDS);\n    private static Supplier<String> saltSupplier = DEFAULT_SALT_SUPPLIER;\n\n    public static void unsafeSet(Supplier<String> newSaltSupplier)\n    {\n        assert newSaltSupplier != null;\n        saltSupplier = newSaltSupplier;\n    }\n    public static void unsafeReset()\n    {\n        saltSupplier = DEFAULT_SALT_SUPPLIER;\n    }\n\n    public static String get()","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordSaltSupplier.java#L23-L59","documentation":"PasswordSaltSupplier reads the system property cassandra.auth_bcrypt_gensalt_log2_rounds to control bcrypt cost. getGensaltLogRounds() validates the value and throws ConfigurationException if it falls outside the supported 4-30 range, preventing startup with a cryptographically invalid or impractical cost factor.","triggerScenarios":"Passing -Dcassandra.auth_bcrypt_gensalt_log2_rounds=<int> outside 4..30 (e.g. 2, 0, 50, negative) at JVM startup; a typo producing a non-parseable-then-clamped or extreme value.","commonSituations":"Operators tuning bcrypt cost for performance/security and overshooting the allowed range; copied startup scripts with aggressive low values; guessing the range instead of reading docs.","solutions":["Set the property to an integer between 4 and 30 inclusive (10-12 is typical)","Remove the -D flag entirely to use the default bcrypt cost","Fix the value in the startup script/systemd unit/cassandra-env.sh where it is defined"],"exampleFix":"// before\nJVM_OPTS=\"$JVM_OPTS -Dcassandra.auth_bcrypt_gensalt_log2_rounds=50\"\n// after\nJVM_OPTS=\"$JVM_OPTS -Dcassandra.auth_bcrypt_gensalt_log2_rounds=12\"","handlingStrategy":"validation","validationCode":"int v = Integer.parseInt(System.getProperty(\"cassandra.auth_bcrypt_gensalt_log2_rounds\", \"10\")); if (v < 4 || v > 30) fail(\"bcrypt rounds must be 4-30\");","typeGuard":"boolean isValidGensaltRounds(String v) { try { int n = Integer.parseInt(v); return n >= 4 && n <= 30; } catch (NumberFormatException e) { return false; } }","tryCatchPattern":"try { startWith(opts); } catch (ConfigurationException e) { if (e.getMessage().contains(\"4 and 30\")) fallbackToDefaultRounds(); }","preventionTips":["Clamp or validate the -D value in cass-env/startup scripts","Document allowed range wherever the flag is set","Prefer removing the flag to using default rounds when unsure"],"tags":["configuration","system-properties","auth"],"backgroundTag":"invalid-env-var-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}