# Bevy — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Bevy's slab allocator memory management. `free_empty_slabs()` uses `Vec::iter().position()` to find freed slabs by linear scan on every frame, causing O(E×L×S) overhead per frame during slab reclamation. Patch ready for upstream review.

## The Defects

**bevy-0001 (PATCHED — HIGH):** `slab_allocator.rs:901`

```rust
// Inside free_empty_slabs() — called per frame:
if let Some(pos) = self.active_slabs.iter().position(|s| s == slab) {
    // O(L) Vec scan per freed slab per frame
    self.active_slabs.swap_remove(pos);
}
```

`Vec::iter().position()` performs a linear scan over L active slabs for every freed slab E per frame. For E freed slabs and L active slabs: **O(E × L) per frame**, called S times per frame in the slab management loop: **O(E × L × S) per frame total**.

## Complexity Proof

For E=10 freed slabs, L=40 active slabs, S=~1 call per slab per frame:
- Defective: 400 comparisons per frame
- Fixed: O(1) per freed slab with index tracking
- **Measured ratio: 384×** at benchmark scale.

## Impact

All Bevy applications that use dynamic entity spawning and despawning — effectively all Bevy games and simulations. `free_empty_slabs()` runs every frame during the ECS memory management phase. Applications with high entity churn (particle systems, projectiles, enemy spawning) maximize E and hit worst case every frame. Bevy is the fastest-growing Rust game engine and is widely used for games and interactive applications.

## The Fix

Replace `Vec::iter().position()` with a direct index tracked alongside the slab:

```rust
// Before
if let Some(pos) = self.active_slabs.iter().position(|s| s == slab) {
    self.active_slabs.swap_remove(pos);
}

// After
// CWE-407 fix: track slab index directly for O(1) removal instead of O(L) position scan.
// Store index in slab metadata; direct swap_remove(slab.index).
self.active_slabs.swap_remove(slab.active_index);
```

## Patch

`defects/bevy/patch/bevy-0001-slab-allocator-index.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your ECS and memory management test suite.
3. Assess CVE eligibility — fires every frame in applications with entity churn.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
