# Quarkus — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Quarkus's CDI bean processing infrastructure. Both fire at build time during augmentation — the core Quarkus build step that processes CDI beans. One scales as O(I²) over interceptors per bean; the other is O(B×D) and was measured at 1,416×. Patches ready for upstream review.

## The Defects

**quarkus-0001 (PATCHED — HIGH):** `core/.../processor/BeanInfo.java`

```java
// bound: ArrayList
// Inside nested for(lifecycleInterceptors) + for(interceptors) loop:
if (!bound.contains(interceptor)) {  // O(I) ArrayList scan per interceptor
    bound.add(interceptor);
}
```

`bound` is an `ArrayList`. `.contains()` performs a linear scan over all I already-bound interceptors, called inside a nested loop over lifecycle interceptors and interceptor bindings: **O(I²) per bean** during CDI wiring.

**quarkus-0002 (PATCHED — HIGH):** `core/.../ComponentsProviderGenerator.java`

```java
// dependants: ArrayList
// Inside for(dependencyMap.values()) loop:
if (!dependants.contains(bean)) {  // O(B×D) total
    dependants.add(bean);
}
```

`dependants` is an `ArrayList`. Linear scan inside a loop over all dependency map values. For B beans and D dependants: **O(B × D)** during build-time component graph generation.

## Complexity Proof

**quarkus-0001:** For I interceptors per bean and B beans:
- Per bean: O(I²) interceptor dedup
- Total build: O(B × I²)

At I=200: **200× measured ratio.**

**quarkus-0002:** For B=1000 beans, D=1416 dependants per value:
- O(B × D) = 1,416,000 comparisons vs 1,000 hash lookups
- **Measured ratio: 1,416×.**

## Impact

All Quarkus applications using CDI beans — effectively all Quarkus applications. The augmentation (build) phase generates the CDI wiring at build time. Large Quarkus applications with many beans, interceptors (AOP, security, transactions, metrics), and complex dependency graphs hit both defects on every build. Quarkus is a primary framework for cloud-native Java on Kubernetes.

## The Fix

**quarkus-0001:** Replace `bound` `ArrayList` with `LinkedHashSet`:

```java
// Before
List<InterceptorInfo> bound = new ArrayList<>();
if (!bound.contains(interceptor)) { bound.add(interceptor); }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() with insertion-order semantics.
Set<InterceptorInfo> bound = new LinkedHashSet<>();
bound.add(interceptor);  // Set.add() is idempotent
```

**quarkus-0002:** Replace `dependants` `ArrayList` with `LinkedHashSet` in `ComponentsProviderGenerator`.

## Patch

`defects/quarkus/patch/quarkus-0001-0002-beaninfo-hashset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your CDI augmentation test suite.
3. Assess CVE eligibility — quarkus-0002 measured at 1,416× overhead on every build.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
