flowable/flowable-engine · critical · IllegalStateException

MD5 algorithm not available. Fatal (should be in the JDK).

Error message

MD5 algorithm not available. Fatal (should be in the JDK).

What it means

DefaultCorrelationKeyGenerator.generateKey() hashes the built correlation string with MD5 and wraps MessageDigest.getInstance("MD5") in an IllegalStateException if the JCE reports NoSuchAlgorithmException. This should be impossible on a compliant JDK, since MD5 is mandated by the platform spec; it indicates a broken or deliberately stripped JCE/Java installation.

Solutions

1. Run on a standard, complete JDK/JRE where MD5 is available
2. Inspect java.security and restore/re-add the provider offering MD5 (e.g. SUN via security.provider.N=... or Security.addProvider)
3. If MD5 must be blocked for compliance, subclass/replace the CorrelationKeyGenerator with a SHA-256-based implementation and register it on the event registry configuration

Example fix

// before
EventRegistryConfiguration config = ...; // default DefaultCorrelationKeyGenerator, FIPS JVM throws
// after
config.setCorrelationKeyGenerator(new Sha256CorrelationKeyGenerator()); // custom generator using SHA-256

null

null

catch (IllegalStateException e) { /* MD5 unavailable: fail with actionable JVM/provider guidance */ }

When it happens

Trigger: Correlation key generation (event correlation on a correlated event) on a JVM whose security provider list excludes MD5 — e.g. a custom JRE with crypto providers removed, hardened java.security settings, or a malformed classpath/limited export policy (historical JCE restrictions).

Common situations: Custom minimal/embedded JREs without crypto providers; java.security files that removed or blocked MD5 for compliance; broken JDK installs; unusual FIPS-only environments.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/996ab71a5823cb50. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-event-registry/src/main/java/org/flowable/eventregistry/impl/DefaultCorrelationKeyGenerator.java:52

 */
public class DefaultCorrelationKeyGenerator implements CorrelationKeyGenerator<Map<String, Object>> {

    @Override
    public String generateKey(Map<String, Object> source) {
        StringBuilder sb = new StringBuilder();
        List<String> keys = new ArrayList<>(source.keySet());
        Collections.sort(keys);
        for (String key : keys) {
            Object sourceValue = source.get(key);
            String value = sourceValue == null ? "" : sourceValue.toString();
            sb.append(key).append("=").append(value).append(";");
        }

        MessageDigest digest;
        try {
            digest = MessageDigest.getInstance("MD5");
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("MD5 algorithm not available. Fatal (should be in the JDK).");
        }

        byte[] bytes = digest.digest(sb.toString().getBytes(StandardCharsets.UTF_8));
        return String.format("%x", new BigInteger(1, bytes));
    }
}

View on GitHub (pinned to d6d39ce1c6)