elastic/elasticsearch · error · IllegalArgumentException

Numeric value length [${length}] exceeds the maximum of [${M

Error message

Numeric value length [${length}] exceeds the maximum of [${MAX_NUMERIC_STRING_LENGTH}]

What it means

Thrown by AbstractXContentParser.checkNumericStringLength() when the text length of a numeric string exceeds MAX_NUMERIC_STRING_LENGTH (1000 characters). This guard rejects pathologically long numeric strings before attempting expensive coercion via Double.parseDouble or BigDecimal, which would have O(n) or worse cost proportional to digit count. The limit mirrors the unquoted JSON number-token limit.

Source

Thrown at libs/x-content/src/main/java/org/elasticsearch/xcontent/support/AbstractXContentParser.java:195

            return parseInt(numericText.string());
        }
        int result = doIntValue();
        ensureNumberConversion(coerce, result, Integer.class);
        return result;
    }

    protected abstract int doIntValue() throws IOException;

    private static final BigInteger LONG_MAX_VALUE_AS_BIGINTEGER = BigInteger.valueOf(Long.MAX_VALUE);
    private static final BigInteger LONG_MIN_VALUE_AS_BIGINTEGER = BigInteger.valueOf(Long.MIN_VALUE);

    // Numeric strings longer than this are rejected before coercion, whose cost grows with the digit count;
    // matches the unquoted JSON number-token limit. Mirrored by Numbers#MAX_NUMERIC_STRING_LENGTH. Keep in sync.
    public static final int MAX_NUMERIC_STRING_LENGTH = 1000;

    private static void checkNumericStringLength(int length) {
        if (length > MAX_NUMERIC_STRING_LENGTH) {
            throw new IllegalArgumentException(
                "Numeric value length [" + length + "] exceeds the maximum of [" + MAX_NUMERIC_STRING_LENGTH + "]"
            );
        }
    }

    /**
     * Returns the {@code long} that {@code stringValue} represents, using the same semantics as the
     * document-indexing path ({@code longValue(coerce)}).
     *
     * <p>Plain integer strings are parsed via {@link Long#parseLong}; strings that cannot be parsed
     * that way (decimals, scientific notation, big integers) fall back to {@link java.math.BigDecimal}.
     * A fractional part is truncated when {@code coerce=true} and rejected with
     * {@link IllegalArgumentException} when {@code coerce=false}. Values outside
     * [{@link Long#MIN_VALUE}, {@link Long#MAX_VALUE}] always throw.
     */
    public static long toLong(String stringValue, boolean coerce) {
        try {
            return Long.parseLong(stringValue);

View on GitHub (pinned to db6a809a66)

Solutions

1. Validate the numeric string length client-side and reject values longer than 1000 characters.
2. If the value is genuinely a large number, use a string field type (keyword or text) instead of a numeric type.
3. Sanitize or truncate untrusted numeric input before indexing.
4. Investigate the source of the overlong numeric string; it is likely a bug or an attack.

Example fix

// before — overlong numeric string
{ "big_number": "123456789012345...<1000+ digits>..." }

// after — store as keyword string if large numbers are needed
PUT /my-index/_mapping
{ "properties": { "big_number": { "type": "keyword" } } }

// Before sending, verify numeric strings are within the length limit
private static final int MAX_NUMERIC_LEN = 1000;
public static void validateNumericStringLength(Object value, String fieldName) {
    String str = (value instanceof Number) ? value.toString() : String.valueOf(value);
    if (str.length() > MAX_NUMERIC_LEN) {
        throw new IllegalArgumentException(fieldName + " numeric value length " + str.length() + " exceeds max of " + MAX_NUMERIC_LEN);
    }
}

try {
    parser.longValue();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("exceeds the maximum")) {
        throw new BadRequestException("Numeric value too long; use a string field type for large numbers");
    }
    throw e;
}

When it happens

Trigger: Providing a numeric field value whose string representation exceeds 1000 characters, such as a number with hundreds of digits or an extremely long fractional part. This can happen with untrusted input, adversarial payloads, or bugs that produce very long numeric strings.

Common situations: Adversarial or malformed input sending very long numbers to exhaust server resources. Accidental generation of extremely long numeric strings (e.g., a serialization bug producing repeated digits). Scientific notation with a very long mantissa.

Related errors

• For input string: "${stringValue}"
• ${clazz.getSimpleName()} value passed as String
• ${fullVal} cannot be converted to ${clazz.getSimpleName()} w
• Value [${text}] is out of range for a short
• Value [${text}] is out of range for an integer

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/22de61cd09534f9f. Report an issue: GitHub.