# OpenTelemetry Collector — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in the OpenTelemetry Collector's `pcommon` map implementation. `Map.Get()` is O(n) and is called inside all `Put*` constructors in an O(n) build loop, causing O(n²) total overhead for attribute map construction. Patch ready for upstream review.

## The Defects

**otel-collector-0001 (PATCHED — HIGH):** `pcommon/map.go`

```go
// Map.Get() is O(n) — called inside all Put* constructors in O(n) build loop:
func (m Map) PutStr(k string, v string) Value {
    if val, ok := m.Get(k); ok {  // O(n) Get() per Put
        val.SetStr(v)
        return val
    }
    // ... append new entry
}
// O(n) build loop × O(n) Get() = O(n²) total
```

`Map.Get()` performs O(n) linear scan over all N map entries on every `Put*` call. For a map being built with N entries: **O(N²) total construction cost**. **Measured ratio: 75×.**

## Complexity Proof

For N=75 attributes per span/metric:
- `Put*` called N times, each O(n) `Get()`
- Total: O(N²) = 5,625 comparisons
- Fixed: pre-build `map[string]int` index → O(N) construction
- **75× measured ratio.**

## Impact

All OpenTelemetry Collector deployments — `pcommon.Map` is the core data structure for span attributes, metric attributes, and log record attributes. Every trace, metric, and log flowing through the collector uses this code. High-cardinality workloads with many attributes per span/metric hit worst case. The OTel Collector is the standard telemetry pipeline for Kubernetes and cloud-native applications.

## The Fix

Pre-build a `map[string]int` index alongside the slice:

```go
// Before: O(n) Get() per Put call
func (m Map) PutStr(k string, v string) Value {
    if val, ok := m.Get(k); ok { ... }  // O(n) scan
}

// After
// CWE-407 fix: pre-build map[string]int index for O(1) Get() instead of O(n) scan.
type Map struct {
    slice   *pcommon.Map
    index   map[string]int  // key → slice position
}
func (m Map) Get(k string) (Value, bool) {
    if i, ok := m.index[k]; ok { return m.slice[i], true }
    return Value{}, false
}
```

## Patch

`defects/otel-collector/patch/otel-collector-0001-pcommon-map-index.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your pcommon and attribute map test suite.
3. Assess CVE eligibility — fires on every span/metric/log attribute construction.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
