{"record":{"id":"fdd47457cc2d42e8","repo":"spring-projects/spring-security","slug":"invalid-memory-parameter","errorCode":null,"errorMessage":"Invalid memory parameter","messagePattern":"Invalid memory parameter","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java","lineNumber":125,"sourceCode":"\t\t\tthrow new IllegalArgumentException(\"Invalid encoded Argon2-hash\");\n\t\t}\n\t\tint currentPart = 1;\n\t\tparamsBuilder = switch (parts[currentPart++]) {\n\t\t\tcase \"argon2d\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_d);\n\t\t\tcase \"argon2i\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_i);\n\t\t\tcase \"argon2id\" -> new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);\n\t\t\tdefault -> throw new IllegalArgumentException(\"Invalid algorithm type: \" + parts[1]);\n\t\t};\n\t\tif (parts[currentPart].startsWith(\"v=\")) {\n\t\t\tparamsBuilder.withVersion(Integer.parseInt(parts[currentPart].substring(2)));\n\t\t\tcurrentPart++;\n\t\t}\n\t\tString[] performanceParams = parts[currentPart++].split(\",\");\n\t\tif (performanceParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\t\tif (!performanceParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tparamsBuilder.withMemoryAsKB(Integer.parseInt(performanceParams[0].substring(2)));\n\t\tif (!performanceParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tparamsBuilder.withIterations(Integer.parseInt(performanceParams[1].substring(2)));\n\t\tif (!performanceParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallelity parameter\");\n\t\t}\n\t\tparamsBuilder.withParallelism(Integer.parseInt(performanceParams[2].substring(2)));\n\t\tparamsBuilder.withSalt(b64decoder.decode(parts[currentPart++]));\n\t\treturn new Argon2Hash(b64decoder.decode(parts[currentPart]), paramsBuilder.build());\n\t}\n\n\tpublic static class Argon2Hash {\n\n\t\tprivate byte[] hash;\n","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/argon2/Argon2EncodingUtils.java#L107-L143","documentation":"Within the performance-parameter segment, the first component must start with 'm=' followed by the memory cost in KB. If performanceParams[0] lacks the 'm=' prefix, decode() throws this IllegalArgumentException. This enforces the PHC parameter ordering (m=,t=,p=) for Argon2.","triggerScenarios":"Calling decode() on a hash whose parameter segment's first field does not begin with 'm=' — e.g. fields reordered to 't=3,m=65536,p=1', or a corrupted segment.","commonSituations":"Hashes produced by tools emitting parameters in non-standard order; manual editing of hash strings; attempts to normalize hashes across libraries that broke the ordering.","solutions":["Rewrite the hash's parameter segment into the canonical 'm=<kb>,t=<it>,p=<par>' order and re-verify with a known password","Regenerate hashes with Spring Security's Argon2PasswordEncoder, which always emits canonical order","Validate the format '$argon2(id|i|d)$v=\\d+$m=\\d+,t=\\d+,p=\\d+$...' before decoding"],"exampleFix":"// before\nString hash = \"$argon2id$v=19$t=3,m=65536,p=1$...\"; // wrong order\n// after\nString hash = \"$argon2id$v=19$m=65536,t=3,p=1$...\";","handlingStrategy":"validation","validationCode":"static boolean paramsInCanonicalOrder(String encodedHash) {\n    String[] parts = encodedHash.split(\"\\\\$\");\n    return parts.length >= 3 && parts[2].matches(\"m=\\\\d+,t=\\\\d+,p=\\\\d+\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return Argon2EncodingUtils.decode(hash);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"parameter\")) {\n        throw new MalformedHashFormatException(hash, e);\n    }\n    throw e;\n}","preventionTips":["Never hand-edit hash strings; rewrite parameters via a re-encode","When migrating hashes, reformat them into canonical 'm=,t=,p=' order and verify with a known password","Add a unit test that decodes a golden hash fixture after any hash-related change"],"tags":["argon2","password-hashing","input-validation","java","spring-security"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}