elastic/elasticsearch · error · IllegalStateException

Hexadecimal string [{}] has odd length and cannot be convert

Error message

Hexadecimal string [{}] has odd length and cannot be converted to a byte array

What it means

Thrown by hexStringToByteArray when the input string has an odd number of characters, which cannot be evenly split into byte pairs. It is an IllegalStateException (unchecked) and currently surfaces through the DEK-Info IV parsing path, where getCipherFromParameters catches IllegalArgumentException — note the mismatch means this specific odd-length case would propagate unwrapped if reached directly, but in practice the IV path triggers the even-length branch first.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java:586

    /**
     * Converts a hexadecimal string to a byte array
     */
    private static byte[] hexStringToByteArray(String hexString) {
        int len = hexString.length();
        if (len % 2 == 0) {
            byte[] data = new byte[len / 2];
            for (int i = 0; i < len; i += 2) {
                final int k = Character.digit(hexString.charAt(i), 16);
                final int l = Character.digit(hexString.charAt(i + 1), 16);
                if (k == -1 || l == -1) {
                    throw new IllegalStateException("String [" + hexString + "] is not hexadecimal");
                }
                data[i / 2] = (byte) ((k << 4) + l);
            }
            return data;
        } else {
            throw new IllegalStateException(
                "Hexadecimal string [" + hexString + "] has odd length and cannot be converted to a byte array"
            );
        }
    }

    /**
     * Parses a DER encoded EC key to an {@link ECPrivateKeySpec} using a minimal {@link DerParser}
     *
     * @param keyBytes the private key raw bytes
     * @return {@link ECPrivateKeySpec}
     * @throws IOException if the DER encoded key can't be parsed
     */
    private static ECPrivateKeySpec parseEcDer(byte[] keyBytes) throws IOException, GeneralSecurityException {
        DerParser parser = new DerParser(keyBytes);
        DerParser.Asn1Object sequence = parser.readAsn1Object();
        parser = sequence.getParser();
        parser.readAsn1Object().getInteger(); // version
        String keyHex = parser.readAsn1Object().getString();

View on GitHub (pinned to db6a809a66)

Solutions

Inspect the hex string length and ensure it is even (each byte is two hex digits).
Regenerate the encrypted key with OpenSSL so the IV is complete and valid.
Pre-validate hex strings in your code before invoking the parser (see defense section).

Defensive patterns

Strategy: validation

Validate before calling

// Reject odd-length hex strings explicitly before parsing
String s = /* hex string */;
if (s == null || s.length() % 2 != 0) {
    throw new IllegalArgumentException("Hex string must have even length: " + s);
}

Try / catch

try { PemUtils.readPrivateKey(path, passwordSupplier); }
catch (RuntimeException e) { if (e.getMessage().contains("odd length")) { /* regenerate key */ } else throw e; }

Prevention

Never truncate hex IVs.
Regenerate encrypted keys to obtain complete IVs.
Pre-validate hex string length before invoking parsers.

When it happens

Trigger: A hex string with odd length (e.g. a truncated IV missing one character, or an extra character appended); a DEK-Info IV whose length is not a multiple of two.

Common situations: Truncated IV from a partial copy-paste; a templating system that dropped or duplicated a character; manual editing that introduced an off-by-one.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/5185b908893464a1. Report an issue: GitHub.