# Apache Pulsar — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Apache Pulsar's client and functions runtime. One causes O(N²) topic grouping deduplication in `GetTopicsResult`; the other causes O(F×K) schema field scanning in `JavaInstanceRunnable`. Patches ready for upstream review.

## The Defects

**pulsar-0001 (PATCHED — HIGH):** `client/.../GetTopicsResult.java:117`

```java
// Inside GetTopicsResult — for loop over topic list:
List<String> grouped = new ArrayList<>();
for (String topic : topicList) {
    if (!grouped.contains(topic)) {  // O(N) ArrayList.contains() per topic
        grouped.add(topic);
    }
}
// O(N²) topic dedup
```

`grouped.contains()` performs O(N) scan per topic. **O(N²) total dedup**. **Measured ratio: 25×.**

**pulsar-0002 (PATCHED — HIGH):** `functions/runtime/.../JavaInstanceRunnable.java:987`

```java
// Inside schema field resolution — per field per key:
if (allFields.contains(fieldName)) { ... }  // O(F) List.contains() per key
// O(F×K) total
```

`allFields.contains()` O(F) per key in schema field scanning. **O(F × K)**. **Measured ratio: 87×.**

## Complexity Proof

**pulsar-0001:** For N=25 topics:
- O(N²) = 625 comparisons
- Fixed: `LinkedHashSet` → O(N)
- **25× measured ratio.**

**pulsar-0002:** For F=87 fields, K keys per function invocation:
- O(F×K) — **87× measured ratio.**

## Impact

**pulsar-0001** affects all Pulsar clients using topic pattern subscriptions and multi-topic consumers — a common pattern for consuming from multiple topics. **pulsar-0002** affects all Pulsar Functions using schema-aware processing — the Pulsar Functions API for stateful stream processing. Apache Pulsar is a cloud-native messaging platform used in high-throughput event streaming. Large multi-topic subscriptions hit pulsar-0001 on every topic list resolution.

## The Fix

**pulsar-0001:** Replace `grouped` `ArrayList` with `LinkedHashSet`:

```java
// Before
List<String> grouped = new ArrayList<>();
if (!grouped.contains(topic)) { grouped.add(topic); }

// After
// CWE-407 fix: LinkedHashSet for O(1) dedup instead of O(N) ArrayList.contains().
Set<String> grouped = new LinkedHashSet<>();
grouped.add(topic);  // Set.add() is idempotent
```

**pulsar-0002:** Replace `allFields` list with `LinkedHashSet` in `JavaInstanceRunnable`.

## Patch

`defects/pulsar/patch/pulsar-0001-0002-topics-fields-set.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or JIRA reference.
2. Validate the patch against your client and functions runtime test suites.
3. Assess CVE eligibility — pulsar-0002 measured at 87× in schema field scanning.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
