# Apache Kylin — CWE-407 Disclosure Brief

**Project:** Apache Kylin (OLAP on Hadoop)
**Disclosure date:** 2026-03-27
**Severity:** MEDIUM
**Speedup:** 21.7×
**Status:** PATCHED

---

## Finding

Apache Kylin's JDBC job scheduler scans a growing list of job IDs using `List.contains()` inside a timer loop, producing O(J²) behavior under sustained job load. Replacing the list with a `HashSet` yields a 21.7× speedup at production job-queue depths.

## The Defect(s)

| ID | Location | Pattern | Complexity |
|----|----------|---------|------------|
| kylin-0001 | `scheduler/JdbcJobScheduler.java:417` | `jobInfoIds.contains()` inside scheduler timer loop | O(J²) |

## Complexity Proof

Let J = jobs tracked in `jobInfoIds`. Each timer tick calls `jobInfoIds.contains()` — O(J) — for each of J jobs: **O(J²)** per tick. At J=1,000, that is 1M comparisons per scheduler tick.

## Impact

Production Kylin deployments with large concurrent job queues. Scheduler timer threads become CPU-bound; segment building is delayed; query fan-out degrades quadratically with job count.

## The Fix

```diff
- List<String> jobInfoIds = new ArrayList<>();
+ Set<String> jobInfoIds = new HashSet<>();
```

## What We Ask

Please review and apply. We request 90-day coordinated disclosure before public release. Reply to security@undefect.com.

---

*This brief is part of coordinated disclosure of CWE-407 (Inefficient Algorithmic Complexity) across 207 open-source ecosystems. Full report: https://undefect.com*
