# Apache Tomcat — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Apache Tomcat's clustering replication valve. The `crossContextSessions` collection is an `ArrayList`, causing O(n²) session lookup overhead on every clustered request that touches cross-context sessions. Patch ready for upstream review.

## The Defects

**tomcat-0001 (PATCHED — HIGH):** `java/org/apache/catalina/ha/tcp/ReplicationValve.java:265`

```java
// crossContextSessions: ArrayList
// Per clustered request:
if (crossContextSessions.contains(session)) {  // O(n) ArrayList scan
    ...
}
```

`crossContextSessions` is an `ArrayList`. `.contains()` performs a linear scan over all N sessions in the list for every membership check. Called on every clustered HTTP request that uses cross-context session replication: **O(n²) total** when sessions accumulate.

## Complexity Proof

For N cross-context sessions:
- Per request: O(N) `contains()` scan
- Over R requests with S sessions: **O(R × N)**
- Accumulated across replication events: **O(N²)**

Fix: replace `ArrayList` with `LinkedHashSet` for O(1) `contains()`.

## Impact

All Apache Tomcat deployments using session replication in a cluster with cross-context sessions. This includes enterprise Java EE applications on Tomcat clusters, applications using `<Manager className="org.apache.catalina.ha.session.DeltaManager">`, and any multi-context web application sharing sessions across contexts. Tomcat is one of the most widely deployed Java application servers globally.

## The Fix

Replace `ArrayList` with `LinkedHashSet`:

```java
// Before
private ArrayList<Session> crossContextSessions = new ArrayList<>();
if (crossContextSessions.contains(session)) { ... }

// After
// CWE-407 fix: LinkedHashSet for O(1) contains() instead of O(n) ArrayList scan.
private LinkedHashSet<Session> crossContextSessions = new LinkedHashSet<>();
if (crossContextSessions.contains(session)) { ... }
```

`LinkedHashSet` preserves insertion order and provides O(1) `contains()`.

## Patch

`defects/tomcat/patch/tomcat-0001-replicationvalve-linkedhashset.patch`

## What We Ask

1. Confirm receipt and assign a Bugzilla or GitHub Security Advisory reference.
2. Validate the patch against your clustering and session replication test suite.
3. Assess CVE eligibility — fires on every clustered request with cross-context sessions.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
