# OpenDaylight — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in OpenDaylight's flow rule management and shard management. One fires on every switch connect/reconnect during group reconciliation; the other fires per snapshot operation in the ShardManager. Patches ready for upstream review.

## The Defects

**odl-0001 (PATCHED — HIGH):** `frm/impl/DevicesGroupRegistry.java:21`

```java
// Inside group reconciliation loop — fires every switch connect/reconnect:
private List<Uint32> registeredGroups = new ArrayList<>();
// ...
if (!registeredGroups.contains(groupId)) {  // O(n) ArrayList.contains() per group
    registeredGroups.add(groupId);
}
```

`ArrayList.contains()` O(n) scan per group in the reconciliation loop. Fires on every switch connect and reconnect event. **O(n²) total** for n groups per switch.

**odl-0002 (PATCHED — HIGH):** `frm/impl/` — `ShardManager snapshotShardList`

```java
// O(n) linear scan per snapshot operation:
for (String shardName : snapshotShardList) {
    if (shardName.equals(target)) { ... }  // O(n) scan per snapshot
}
```

O(n) linear scan over `snapshotShardList` per snapshot operation in `ShardManager`.

## Complexity Proof

**odl-0001:** For n groups per switch:
- Per reconnect: O(n²) reconciliation
- Fixed: `LinkedHashSet<Uint32>` → O(n)

**odl-0002:** For n shards:
- Per snapshot: O(n) scan
- Fixed: `HashSet<String>` → O(1) per lookup

## Impact

All OpenDaylight deployments with flow rule management (odl-0001) and distributed datastore with shard management (odl-0002). OpenDaylight is the leading open-source SDN controller platform used in network virtualization and telecom applications. odl-0001 fires on every switch connect/reconnect — frequent in production networks during topology changes. odl-0002 fires during datastore snapshotting in clustered deployments.

## The Fix

**odl-0001:** Replace `registeredGroups` `ArrayList` with `LinkedHashSet`:

```java
// Before
private List<Uint32> registeredGroups = new ArrayList<>();
if (!registeredGroups.contains(groupId)) { registeredGroups.add(groupId); }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(n) ArrayList scan.
private Set<Uint32> registeredGroups = new LinkedHashSet<>();
registeredGroups.add(groupId);  // Set.add() is idempotent
```

**odl-0002:** Replace `snapshotShardList` with `HashSet<String>`.

## Patch

`defects/odl/patch/odl-0001-0002-group-shard-hashset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or JIRA reference.
2. Validate the patch against your flow rule reconciliation and shard management test suite.
3. Assess CVE eligibility — odl-0001 fires on every switch connect/reconnect event.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
