{"record":{"id":"ff0226dc560596cc","repo":"grpc/grpc-java","slug":"failed-to-parse-envoy-config-core-v3-address-port","errorCode":null,"errorMessage":"Failed to parse envoy.config.core.v3.Address: Port value %d out of range 1-65535.","messagePattern":"Failed to parse envoy\\.config\\.core\\.v3\\.Address: Port value (.+?) out of range 1-65535\\.","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsEndpointResource.java","lineNumber":339,"sourceCode":"      validateAddress(socketAddress);\n\n      String ip = socketAddress.getAddress();\n      int port = socketAddress.getPortValue();\n\n      try {\n        return new InetSocketAddress(InetAddresses.forString(ip), port);\n      } catch (IllegalArgumentException e) {\n        throw createException(\"Invalid IP address or port: \" + ip + \":\" + port);\n      }\n    }\n\n    private void validateAddress(SocketAddress socketAddress) throws ResourceInvalidException {\n      if (socketAddress.getAddress().isEmpty()) {\n        throw createException(\"Address field is empty or invalid.\");\n      }\n      long port = Integer.toUnsignedLong(socketAddress.getPortValue());\n      if (port > 65535) {\n        throw createException(String.format(\"Port value %d out of range 1-65535.\", port));\n      }\n    }\n\n    private ResourceInvalidException createException(String message) {\n      return new ResourceInvalidException(\n          \"Failed to parse envoy.config.core.v3.Address: \" + message);\n    }\n  }\n}\n","sourceCodeStart":321,"sourceCodeEnd":349,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsEndpointResource.java#L321-L349","documentation":"XdsEndpointResource.validateAddress checks that the SocketAddress port fits in the valid 1-65535 range. The port is stored in the proto as uint32, so values above 65535 are representable but invalid for TCP; the validator converts it to an unsigned long and throws ResourceInvalidException 'Port value N out of range 1-65535.', causing the xDS resource to be rejected.","triggerScenarios":"An xDS SocketAddress whose port_value (uint32) exceeds 65535 in an EDS/cluster address; validateAddress is invoked from XdsEndpointResource.parse after the address-string check passes.","commonSituations":"Control-plane or tooling bug writing large uint32 values (e.g. accidental byte-order swaps producing 0x… values, or passing an offset/hash instead of a port); generated configs where a placeholder was replaced by a non-port number.","solutions":["Correct the port_value in the management server config to be within 1-65535.","Find and fix the producer of the bad value (look for byte-swap/endianness or wrong-field bugs in the control plane or config generation tooling).","Validate port ranges in your config-generation pipeline before publishing xDS resources.","Inspect the exact resource in ADS logs to confirm which endpoint carries the out-of-range port."],"exampleFix":"# before\naddress: { socket_address: { address: \"10.0.0.5\", port_value: 987654 } }\n\n# after\naddress: { socket_address: { address: \"10.0.0.5\", port_value: 50051 } }","handlingStrategy":"validation","validationCode":"int port = socketAddress.getPortValue();\nif (Integer.toUnsignedLong(port) < 1 || Integer.toUnsignedLong(port) > 65535) {\n  throw new IllegalArgumentException(\"port_value must be 1-65535, got: \" + Integer.toUnsignedLong(port));\n}","typeGuard":"static boolean isPortInRange(long port) {\n  return port >= 1 && port <= 65535;\n}","tryCatchPattern":"try {\n  applyEndpointResource(resource);\n} catch (ResourceInvalidException e) {\n  logger.error(\"xDS resource port out of range: \" + e.getMessage());\n  rejectAndNack(resource);\n}","preventionTips":["Enforce 1-65535 port validation in config-generation pipelines before publishing xDS resources.","Guard control-plane code against endianness/field-swap bugs that produce large uint32 ports.","Add unit tests for your control plane covering port boundary values (0, 1, 65535, 65536).","Log the offending resource name when gRPC NACKs so the bad producer is quickly identified."],"tags":["grpc","xds","envoy","port-validation","value-out-of-range"],"backgroundTag":"value-out-of-range","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}