diff --git a/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java b/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
index a04e224b81c..ffac7508d0a 100644
--- a/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
+++ b/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java
@@ -265,7 +265,15 @@ public final class TokenService extends AbstractComponent {
                 listener.onResponse(null);
             } else {
                 try {
-                    decodeAndValidateToken(token, listener);
+                    decodeAndValidateToken(token, ActionListener.wrap(listener::onResponse, e -> {
+                        if (e instanceof IOException) {
+                            // could happen with a token that is not ours
+                            logger.debug("invalid token", e);
+                            listener.onResponse(null);
+                        } else {
+                            listener.onFailure(e);
+                        }
+                    }));
                 } catch (IOException e) {
                     // could happen with a token that is not ours
                     logger.debug("invalid token", e);
diff --git a/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/AuthenticationServiceTests.java b/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/AuthenticationServiceTests.java
index 56ecf5ce173..192fbc3d497 100644
--- a/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/AuthenticationServiceTests.java
+++ b/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/AuthenticationServiceTests.java
@@ -886,7 +886,19 @@ public class AuthenticationServiceTests extends ESTestCase {
                 assertEquals(expected, result);
                 success.set(true);
                 latch.countDown();
-            }, this::logAndFail));
+            }, e -> {
+                if (e instanceof IllegalStateException) {
+                    assertThat(e.getMessage(), containsString("array length must be <= to " + ArrayUtil.MAX_ARRAY_LENGTH  + " but was: "));
+                    latch.countDown();
+                } else if (e instanceof NegativeArraySizeException) {
+                    assertThat(e.getMessage(), containsString("array size must be positive but was: "));
+                    latch.countDown();
+                } else {
+                    logger.error("unexpected exception", e);
+                    latch.countDown();
+                    fail("unexpected exception: " + e.getMessage());
+                }
+            }));
         } catch (IllegalStateException ex) {
             assertThat(ex.getMessage(), containsString("array length must be <= to " + ArrayUtil.MAX_ARRAY_LENGTH  + " but was: "));
             latch.countDown();