{"record":{"id":"e6d8a68265cc616d","repo":"elastic/elasticsearch","slug":"invalid-der-length-field-too-big","errorCode":null,"errorMessage":"Invalid DER: length field too big ({})","messagePattern":"Invalid DER: length field too big \\((.+?)\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":135,"sourceCode":"     * number of additional length octets. Second and following\n     * octets give the length, base 256, most significant digit first.\n     * </li>\n     * </ul>\n     *\n     * @return The length as integer\n     */\n    private int getLength() throws IOException {\n\n        int i = derInputStream.read();\n        if (i == -1) throw new IOException(\"Invalid DER: length missing\");\n\n        // A single byte short length\n        if ((i & ~0x7F) == 0) return i;\n\n        int num = i & 0x7F;\n\n        // We can't handle length longer than 4 bytes\n        if (i >= 0xFF || num > 4) throw new IOException(\"Invalid DER: length field too big (\" + i + \")\"); //$NON-NLS-2$\n\n        byte[] bytes = new byte[num];\n        int n = derInputStream.read(bytes);\n        if (n < num) throw new IOException(\"Invalid DER: length too short\");\n\n        int len = new BigInteger(1, bytes).intValue();\n        if (len < 0) {\n            throw new IOException(\"Invalid DER: length larger than max-int\");\n        }\n\n        return len;\n    }\n\n    /**\n     * An ASN.1 TLV. The object is not parsed. It can\n     * only handle integers.\n     *\n     * @author zhang","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L117-L153","documentation":"Thrown by DerParser.getLength() in long-form length decoding when the first length octet is 0xFF (reserved/indefinite in DER) or when the number of subsequent length octets exceeds 4. DER length fields use long form only for sizes that don't fit in a single byte, and this parser caps support at 4 length bytes (enough for ~4 GiB).","triggerScenarios":"getLength() reads i where (i & ~0x7F) != 0 (long form), then checks i >= 0xFF || (i & 0x7F) > 4. Fires on DER where the length-of-length byte is 0x85+ or exactly 0xFF — typical of malformed or non-DER (BER indefinite-length) input.","commonSituations":"BER (not DER) input that uses indefinite-length encoding (0x80), corrupt bytes that coincidentally look like a huge length, or a malformed key produced by a buggy/non-conformant encoder.","solutions":["Ensure the source emits DER (definite length), not BER with indefinite length. Re-encode with `openssl asn1parse -genconf` or `openssl pkcs8 -topk8`.","Re-export the key from a trusted tool (openssl, keytool) to guarantee DER compliance.","Inspect the bytes around the failing offset with a hex dump (`xxd`) to confirm the length octets are sensible.","If you control the producer, validate length encoding before writing DER output."],"exampleFix":"// before: feeding BER with indefinite length\nnew DerParser(berBytes).readAsn1Object();\n\n// after: convert to DER first\n// openssl pkcs8 -topk8 -inform BER -inkey ber.key -outform DER -out der.key\nbyte[] der = Files.readAllBytes(Path.of(\"der.key\"));\nnew DerParser(der).readAsn1Object();","handlingStrategy":"validation","validationCode":"// Reject indefinite-length (BER) or implausibly large length headers early.\nprivate static void requireDerLength(byte[] der, int idx) {\n    int i = der[idx] & 0xFF;\n    if (i == 0x80) throw new IllegalArgumentException(\"indefinite length (BER) not supported\");\n    if (i == 0xFF || (i & 0x7F) > 4) {\n        throw new IllegalArgumentException(\"length field too big or reserved: 0x\" + Integer.toHexString(i));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure your toolchain emits DER (definite length), not BER indefinite.","Re-encode keys with `openssl pkcs8 -topk8` for guaranteed DER compliance.","Validate length-octet shape before constructing DerParser."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}