diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index 210ea0813..5d2295de9 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -341,5 +341,242 @@ "weechat-0001": "UNDF-2026-000000340", "wireshark-0001": "UNDF-2026-000000341", "zeek-0001": "UNDF-2026-000000342", - "zookeeper-0001": "UNDF-2026-000000343" + "zookeeper-0001": "UNDF-2026-000000343", + "actix-0003": "UNDF-2026-000000344", + "actix-web-0001": "UNDF-2026-000000345", + "actix-web-0002": "UNDF-2026-000000346", + "airflow-0001": "UNDF-2026-000000347", + "ant-0001": "UNDF-2026-000000348", + "argo-workflows-0001": "UNDF-2026-000000349", + "artemis-0001": "UNDF-2026-000000350", + "asterisk-0003": "UNDF-2026-000000351", + "axum-0001": "UNDF-2026-000000352", + "beam-0001": "UNDF-2026-000000353", + "binutils-0001": "UNDF-2026-000000354", + "bird-0003": "UNDF-2026-000000355", + "bird-0004": "UNDF-2026-000000356", + "bitcoin-0001": "UNDF-2026-000000357", + "buck2-0001": "UNDF-2026-000000358", + "bun-0001": "UNDF-2026-000000359", + "camel-0001": "UNDF-2026-000000360", + "celery-0002": "UNDF-2026-000000361", + "chef-0001": "UNDF-2026-000000362", + "cilium-0002": "UNDF-2026-000000363", + "cilium-0003": "UNDF-2026-000000364", + "cilium-0004": "UNDF-2026-000000365", + "clojure-0001": "UNDF-2026-000000366", + "consul-0001": "UNDF-2026-000000367", + "containerd-0001": "UNDF-2026-000000368", + "crystal-0001": "UNDF-2026-000000369", + "crystal-0002": "UNDF-2026-000000370", + "crystal-0003": "UNDF-2026-000000371", + "crystal-0004": "UNDF-2026-000000372", + "dart-0001": "UNDF-2026-000000373", + "dart-0002": "UNDF-2026-000000374", + "dart-0003": "UNDF-2026-000000375", + "deno-0001": "UNDF-2026-000000376", + "dgraph-0001": "UNDF-2026-000000377", + "django-0005": "UNDF-2026-000000378", + "django-0006": "UNDF-2026-000000379", + "doctrine-orm": "UNDF-2026-000000380", + "doris-0001": "UNDF-2026-000000381", + "dragonfly-0001": "UNDF-2026-000000382", + "druid-0001": "UNDF-2026-000000383", + "eclipse-jdt-0001": "UNDF-2026-000000384", + "elasticsearch-0001": "UNDF-2026-000000385", + "element-web": "UNDF-2026-000000386", + "elixir-0001": "UNDF-2026-000000387", + "emacs-0001": "UNDF-2026-000000388", + "emacs-0002": "UNDF-2026-000000389", + "envoy-0002": "UNDF-2026-000000390", + "envoy-0003": "UNDF-2026-000000391", + "etcd-0001": "UNDF-2026-000000392", + "express-0001": "UNDF-2026-000000393", + "fish-0001": "UNDF-2026-000000394", + "flink-0002": "UNDF-2026-000000395", + "flink-0003": "UNDF-2026-000000396", + "flink-0004": "UNDF-2026-000000397", + "flink-0005": "UNDF-2026-000000398", + "flutter-0001": "UNDF-2026-000000399", + "foundationdb-0001": "UNDF-2026-000000400", + "frrouting-0003": "UNDF-2026-000000401", + "frrouting-0004": "UNDF-2026-000000402", + "gdb-0001": "UNDF-2026-000000403", + "glib-0001": "UNDF-2026-000000404", + "graal-0001": "UNDF-2026-000000405", + "grafana-0002": "UNDF-2026-000000406", + "graphhopper-0001": "UNDF-2026-000000407", + "graphhopper-0002": "UNDF-2026-000000408", + "groovy-0001": "UNDF-2026-000000409", + "groovy-0002": "UNDF-2026-000000410", + "grpc-0001": "UNDF-2026-000000411", + "gunicorn-0001": "UNDF-2026-000000412", + "haproxy-0002": "UNDF-2026-000000413", + "haproxy-0003": "UNDF-2026-000000414", + "hazelcast-0001": "UNDF-2026-000000415", + "hazelcast-0002": "UNDF-2026-000000416", + "hibernate-0006": "UNDF-2026-000000417", + "httpd-0002": "UNDF-2026-000000418", + "httpd-0003": "UNDF-2026-000000419", + "httpd-0004": "UNDF-2026-000000420", + "hudi-0001": "UNDF-2026-000000421", + "hudi-0002": "UNDF-2026-000000422", + "hudi-0003": "UNDF-2026-000000423", + "hypercorn-0001": "UNDF-2026-000000424", + "iceberg-0001": "UNDF-2026-000000425", + "intellij-0001": "UNDF-2026-000000426", + "istio-0002": "UNDF-2026-000000427", + "istio-0003": "UNDF-2026-000000428", + "jami-daemon": "UNDF-2026-000000429", + "janusgraph-0001": "UNDF-2026-000000430", + "jax-0001": "UNDF-2026-000000431", + "jitsi-videobridge": "UNDF-2026-000000432", + "jsc-0001": "UNDF-2026-000000433", + "jsc-0002": "UNDF-2026-000000434", + "kafka-0004": "UNDF-2026-000000435", + "kafka-0005": "UNDF-2026-000000436", + "kafka-0006": "UNDF-2026-000000437", + "kafka-0007": "UNDF-2026-000000438", + "kafka-0008": "UNDF-2026-000000439", + "koa-0001": "UNDF-2026-000000440", + "ktor-0001": "UNDF-2026-000000441", + "kubeflow-0001": "UNDF-2026-000000442", + "kubernetes-0004": "UNDF-2026-000000443", + "kubernetes-0005": "UNDF-2026-000000444", + "kubernetes-0006": "UNDF-2026-000000445", + "kubernetes-0007": "UNDF-2026-000000446", + "kylin-0001": "UNDF-2026-000000447", + "leveldb-0001": "UNDF-2026-000000448", + "libgdx-0002": "UNDF-2026-000000449", + "libgdx-0003": "UNDF-2026-000000450", + "lighttpd-0001": "UNDF-2026-000000451", + "linkerd2-0002": "UNDF-2026-000000452", + "lldb-0001": "UNDF-2026-000000453", + "lmdb-0001": "UNDF-2026-000000454", + "love2d-0002": "UNDF-2026-000000455", + "love2d-0003": "UNDF-2026-000000456", + "make-0001": "UNDF-2026-000000457", + "mbedtls-0001": "UNDF-2026-000000458", + "mbedtls-0002": "UNDF-2026-000000459", + "metaflow-0001": "UNDF-2026-000000460", + "micronaut-0001": "UNDF-2026-000000461", + "micronaut-0002": "UNDF-2026-000000462", + "micronaut-0003": "UNDF-2026-000000463", + "mlflow-0001": "UNDF-2026-000000464", + "mongodb-0008": "UNDF-2026-000000465", + "nats-0001": "UNDF-2026-000000466", + "neo4j-0001": "UNDF-2026-000000467", + "neovim-0001": "UNDF-2026-000000468", + "netty-0001": "UNDF-2026-000000469", + "nginx-0002": "UNDF-2026-000000470", + "nginx-0003": "UNDF-2026-000000471", + "nifi-0001": "UNDF-2026-000000472", + "nim-0001": "UNDF-2026-000000473", + "nim-0002": "UNDF-2026-000000474", + "nodejs-0001": "UNDF-2026-000000475", + "nomad-0001": "UNDF-2026-000000476", + "nomad-0002": "UNDF-2026-000000477", + "nomad-0003": "UNDF-2026-000000478", + "nomad-0004": "UNDF-2026-000000479", + "numpy-0001": "UNDF-2026-000000480", + "octave-0002": "UNDF-2026-000000481", + "open3d-0001": "UNDF-2026-000000482", + "open3d-0002": "UNDF-2026-000000483", + "openbgpd-0001": "UNDF-2026-000000484", + "opencv-0001": "UNDF-2026-000000485", + "opencv-0002": "UNDF-2026-000000486", + "opensearch-0001": "UNDF-2026-000000487", + "openssh-0001": "UNDF-2026-000000488", + "openssh-0002": "UNDF-2026-000000489", + "openssl-0003": "UNDF-2026-000000490", + "openssl-0004": "UNDF-2026-000000491", + "opentofu-0001": "UNDF-2026-000000492", + "opentofu-0002": "UNDF-2026-000000493", + "optuna-0001": "UNDF-2026-000000494", + "osrm-0001": "UNDF-2026-000000495", + "otel-collector": "UNDF-2026-000000496", + "pandas-0001": "UNDF-2026-000000497", + "php-0003": "UNDF-2026-000000498", + "php-0004": "UNDF-2026-000000499", + "pinot-0001": "UNDF-2026-000000500", + "podman-0001": "UNDF-2026-000000501", + "podman-0002": "UNDF-2026-000000502", + "prometheus-0002": "UNDF-2026-000000503", + "prosody-0001": "UNDF-2026-000000504", + "pulsar-0001": "UNDF-2026-000000505", + "pulsar-0002": "UNDF-2026-000000506", + "pulsar-0003": "UNDF-2026-000000507", + "pulsar-0004": "UNDF-2026-000000508", + "pulsar-0005": "UNDF-2026-000000509", + "pulumi-0001": "UNDF-2026-000000510", + "python-igraph-0001": "UNDF-2026-000000511", + "pytorch-0001": "UNDF-2026-000000512", + "pytorch-0002": "UNDF-2026-000000513", + "pytorch-0003": "UNDF-2026-000000514", + "pytorch-geometric-0001": "UNDF-2026-000000515", + "qemu-0001": "UNDF-2026-000000516", + "quarkus-0001": "UNDF-2026-000000517", + "quarkus-0002": "UNDF-2026-000000518", + "r-source": "UNDF-2026-000000519", + "rabbitmq-0005": "UNDF-2026-000000520", + "rails-0006": "UNDF-2026-000000521", + "raylib-0002": "UNDF-2026-000000522", + "redis-0004": "UNDF-2026-000000523", + "rocksdb-0001": "UNDF-2026-000000524", + "ros2-0001": "UNDF-2026-000000525", + "ros2-0002": "UNDF-2026-000000526", + "rustc-0004": "UNDF-2026-000000527", + "samza-0001": "UNDF-2026-000000528", + "scylladb-0001": "UNDF-2026-000000529", + "signal-server": "UNDF-2026-000000530", + "simplex-chat": "UNDF-2026-000000531", + "sklearn-0001": "UNDF-2026-000000532", + "solr-0001": "UNDF-2026-000000533", + "spark-0002": "UNDF-2026-000000534", + "spark-0004": "UNDF-2026-000000535", + "spidermonkey-0002": "UNDF-2026-000000536", + "spidermonkey-0003": "UNDF-2026-000000537", + "spidermonkey-0004": "UNDF-2026-000000538", + "spring-0004": "UNDF-2026-000000539", + "spring-0005": "UNDF-2026-000000540", + "spring-0006": "UNDF-2026-000000541", + "sqlalchemy-0003": "UNDF-2026-000000542", + "starrocks-0001": "UNDF-2026-000000543", + "strongswan-0001": "UNDF-2026-000000544", + "swift-0001": "UNDF-2026-000000545", + "swift-0002": "UNDF-2026-000000546", + "systemd-0001": "UNDF-2026-000000547", + "systemd-0002": "UNDF-2026-000000548", + "tcl-0001": "UNDF-2026-000000549", + "tcpdump-0001": "UNDF-2026-000000550", + "tensorflow-0001": "UNDF-2026-000000551", + "threejs-0006": "UNDF-2026-000000552", + "thrift-0001": "UNDF-2026-000000553", + "tikv-0001": "UNDF-2026-000000554", + "tokio-0001": "UNDF-2026-000000555", + "tomcat-0002": "UNDF-2026-000000556", + "traefik-0001": "UNDF-2026-000000557", + "traefik-0002": "UNDF-2026-000000558", + "traefik-0003": "UNDF-2026-000000559", + "trino-0001": "UNDF-2026-000000560", + "undertow-0001": "UNDF-2026-000000561", + "uvicorn-0001": "UNDF-2026-000000562", + "uwsgi-0001": "UNDF-2026-000000563", + "v8-0002": "UNDF-2026-000000564", + "v8-0003": "UNDF-2026-000000565", + "valhalla-0001": "UNDF-2026-000000566", + "varnish-0002": "UNDF-2026-000000567", + "varnish-0003": "UNDF-2026-000000568", + "vault-0001": "UNDF-2026-000000569", + "vertx-0001": "UNDF-2026-000000570", + "vim-0001": "UNDF-2026-000000571", + "vim-0002": "UNDF-2026-000000572", + "waitress-0001": "UNDF-2026-000000573", + "weechat-0002": "UNDF-2026-000000574", + "wireguard-tools": "UNDF-2026-000000575", + "wolfssl-0001": "UNDF-2026-000000576", + "yugabyte-0001": "UNDF-2026-000000577", + "zig-0001": "UNDF-2026-000000578", + "zsh-0001": "UNDF-2026-000000579", + "zulip-0001": "UNDF-2026-000000580" } diff --git a/defects/activemq/patch/activemq-deeper-CLEAN.md b/defects/activemq/patch/activemq-deeper-CLEAN.md index 702dccb79..13c1689a5 100644 --- a/defects/activemq/patch/activemq-deeper-CLEAN.md +++ b/defects/activemq/patch/activemq-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000001 # Apache ActiveMQ CWE-407 Scan — CLEAN (deeper scan, beyond activemq-0001) **Date:** 2026-03-27 diff --git a/defects/actix-web/patch/actix-web-0001-update-unique-vec-contains.md b/defects/actix-web/patch/actix-web-0001-update-unique-vec-contains.md index c26a8e229..235dfe32f 100644 --- a/defects/actix-web/patch/actix-web-0001-update-unique-vec-contains.md +++ b/defects/actix-web/patch/actix-web-0001-update-unique-vec-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000345 # actix-web-0001: introspection update_unique Vec::contains() O(N×M) during route registration **Severity:** MEDIUM diff --git a/defects/actix-web/patch/actix-web-0002-ws-protocol-negotiation-set.md b/defects/actix-web/patch/actix-web-0002-ws-protocol-negotiation-set.md index 55a0684c9..cde41f1de 100644 --- a/defects/actix-web/patch/actix-web-0002-ws-protocol-negotiation-set.md +++ b/defects/actix-web/patch/actix-web-0002-ws-protocol-negotiation-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000346 # actix-web-0002: WebSocket handshake protocol negotiation O(R×P) per upgrade request **Severity:** MEDIUM diff --git a/defects/actix/patch/actix-web-0003-introspection-update-unique.md b/defects/actix/patch/actix-web-0003-introspection-update-unique.md index 157fcade5..bc7917007 100644 --- a/defects/actix/patch/actix-web-0003-introspection-update-unique.md +++ b/defects/actix/patch/actix-web-0003-introspection-update-unique.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000344 # actix-0001 — CWE-407: introspection `update_unique` O(R×G) Vec linear dedup **Project:** actix-web diff --git a/defects/airflow/patch/airflow-0001-topological-sort-quadratic.md b/defects/airflow/patch/airflow-0001-topological-sort-quadratic.md index 95f68ce51..89bdee9aa 100644 --- a/defects/airflow/patch/airflow-0001-topological-sort-quadratic.md +++ b/defects/airflow/patch/airflow-0001-topological-sort-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000347 # airflow-0001 — O(N²) Topological Sort in TaskGroup **Severity:** HIGH diff --git a/defects/ansible/patch/ans-0001-role-get-vars-seen-id-set.md b/defects/ansible/patch/ans-0001-role-get-vars-seen-id-set.md index 11da3472e..200f7402f 100644 --- a/defects/ansible/patch/ans-0001-role-get-vars-seen-id-set.md +++ b/defects/ansible/patch/ans-0001-role-get-vars-seen-id-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000005 # ans-0001: role get_vars() seen-list O(D²) deduplication over transitive dependencies **Severity:** MEDIUM diff --git a/defects/ansible/patch/ansible-0001-role-get-vars-seen-list.md b/defects/ansible/patch/ansible-0001-role-get-vars-seen-list.md index 40f827283..3d5144a59 100644 --- a/defects/ansible/patch/ansible-0001-role-get-vars-seen-list.md +++ b/defects/ansible/patch/ansible-0001-role-get-vars-seen-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000005 # ansible-0001: Role.get_vars() seen-list O(D²) deduplication ## Classification diff --git a/defects/ansible/patch/ansible-0002-role-collections-set.md b/defects/ansible/patch/ansible-0002-role-collections-set.md index 0826214da..6cbdce99c 100644 --- a/defects/ansible/patch/ansible-0002-role-collections-set.md +++ b/defects/ansible/patch/ansible-0002-role-collections-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000006 # ans-0002: role _load_role_data() collections list O(C) membership tests per role load **Severity:** LOW diff --git a/defects/ant/patch/ant-CLEAN.md b/defects/ant/patch/ant-CLEAN.md index 4dcf8d484..519dec968 100644 --- a/defects/ant/patch/ant-CLEAN.md +++ b/defects/ant/patch/ant-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000348 ## Apache Ant — CWE-407 Scan Result: CLEAN Scanned: `src/main/org/apache/tools/ant/` (depth=1 clone, 2026-03-27) diff --git a/defects/argo-workflows/patch/argo-0001-get-task-linear-scan.md b/defects/argo-workflows/patch/argo-0001-get-task-linear-scan.md index b0c7f7b87..371b1445b 100644 --- a/defects/argo-workflows/patch/argo-0001-get-task-linear-scan.md +++ b/defects/argo-workflows/patch/argo-0001-get-task-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000349 # argo-0001 — O(N) Linear Scan in GetTask() Called Inside DAG Execution Loop **Severity:** HIGH diff --git a/defects/artemis/patch/artemis-0001-bindingsimpl-routefromcluster-hashset.md b/defects/artemis/patch/artemis-0001-bindingsimpl-routefromcluster-hashset.md index 072c13fcd..3adfce8b2 100644 --- a/defects/artemis/patch/artemis-0001-bindingsimpl-routefromcluster-hashset.md +++ b/defects/artemis/patch/artemis-0001-bindingsimpl-routefromcluster-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000350 # artemis-0001: BindingsImpl routeFromCluster O(R×A) → O(R+A) ## Location diff --git a/defects/artemis/patch/artemis-CLEAN.md b/defects/artemis/patch/artemis-CLEAN.md index eacb04809..2b8ce2eaa 100644 --- a/defects/artemis/patch/artemis-CLEAN.md +++ b/defects/artemis/patch/artemis-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000350 # ActiveMQ Artemis CWE-407 Scan — CLEAN (beyond artemis-0001) **Date:** 2026-03-28 diff --git a/defects/asterisk/patch/asterisk-0003-cdr-variable-merge-quadratic.md b/defects/asterisk/patch/asterisk-0003-cdr-variable-merge-quadratic.md index 1a7591ad0..e48a259cb 100644 --- a/defects/asterisk/patch/asterisk-0003-cdr-variable-merge-quadratic.md +++ b/defects/asterisk/patch/asterisk-0003-cdr-variable-merge-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000351 # asterisk-0003: CDR Variable Merge O(B×V) Quadratic Membership Scan ## Classification diff --git a/defects/axum/patch/axum-CLEAN.md b/defects/axum/patch/axum-CLEAN.md index 22357c46c..1f7a49b73 100644 --- a/defects/axum/patch/axum-CLEAN.md +++ b/defects/axum/patch/axum-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000352 # axum — CWE-407 Scan Result: CLEAN **Date:** 2026-03-27 diff --git a/defects/bazel/patch/bazel-0003-feature-selection-hashset.md b/defects/bazel/patch/bazel-0003-feature-selection-hashset.md new file mode 100644 index 000000000..58b5f9271 --- /dev/null +++ b/defects/bazel/patch/bazel-0003-feature-selection-hashset.md @@ -0,0 +1,57 @@ +# bazel-0003: FeatureSelection ImmutableList.contains O(P×S×L) → O(P×S) with HashSet + +## Classification + +| Field | Value | +|-------------|-------| +| CWE | CWE-407 Inefficient Algorithmic Complexity | +| Severity | MEDIUM | +| Component | `src/main/java/com/google/devtools/build/lib/rules/cpp/FeatureSelection.java:159` | +| Function | `FeatureSelection.run()` — provides-conflict check | +| Hot path | Once per action type per C++ target in `computeFeatureConfiguration()` | +| Status | PATCHED (unit test PASS) | + +## Defect + +`FeatureSelection.run()` iterates over `provides.keys()` (P unique provide-strings) and +for each iterates `provides.get(provided)` (S selectables), calling +`enabledActivatablesInOrder.contains(...)` — an O(L) scan of an `ImmutableList`: + +```java +// FeatureSelection.java:159 +ImmutableList enabledActivatablesInOrder = ...; // L entries + +for (String provided : provides.keys()) { // P provide-strings + for (CrosstoolSelectable selectable : provides.get(provided)) { // S selectables + if (enabledActivatablesInOrder.contains( // O(L) linear scan + selectableProvidingString)) { + ... + } + } +} +``` + +`ImmutableList.contains()` is O(L) — walks every element. With P=7, S=6, L=80: +**~3,360 comparisons per call** vs ~42 with a HashSet (80×). + +`computeFeatureConfiguration()` is called once per action type per target in C++ builds. +Large monorepo builds with thousands of C++ targets hit this path repeatedly. + +## Fix + +Build a `HashSet` from `enabledActivatablesInOrder` once before the +outer loop: + +```java +Set enabledSet = new HashSet<>(enabledActivatablesInOrder); + +for (String provided : provides.keys()) { + for (CrosstoolSelectable selectable : provides.get(provided)) { + if (enabledSet.contains(selectableProvidingString)) { // O(1) + ... + } + } +} +``` + +Speedup: ~80× at realistic scale (L=80, P=7, S=6). diff --git a/defects/bazel/unit/BazelFeatureSelectionAlgorithmTest.java b/defects/bazel/unit/BazelFeatureSelectionAlgorithmTest.java new file mode 100644 index 000000000..6ca610e96 --- /dev/null +++ b/defects/bazel/unit/BazelFeatureSelectionAlgorithmTest.java @@ -0,0 +1,151 @@ +package unit; + +import java.util.*; + +/** + * Models Bazel FeatureSelection.run() provides-conflict check. + * + * SLOW: O(P×S×L) — ImmutableList.contains() O(L) per selectable in P×S nested loops. + * FAST: O(P×S) — HashSet built once from enabledList; O(1) per lookup. + * + * CWE-407: src/main/java/com/google/devtools/build/lib/rules/cpp/FeatureSelection.java:159 + */ +public class BazelFeatureSelectionAlgorithmTest { + + // ------------------------------------------------------------------------- + // Slow — ImmutableList.contains() O(L) per lookup + // ------------------------------------------------------------------------- + + static class SlowFeatureSelection { + long cmpOps = 0; + + boolean listContains(List list, String val) { + for (String s : list) { + cmpOps++; + if (s.equals(val)) return true; + } + return false; + } + + /** + * O(P × S × L): for each provide × selectable, check enabledList membership. + * Returns count of conflict checks performed. + */ + int run(List enabledList, + Map> providesMap) { + int conflicts = 0; + for (Map.Entry> entry : providesMap.entrySet()) { + for (String selectable : entry.getValue()) { + if (listContains(enabledList, selectable)) { + conflicts++; + } + } + } + return conflicts; + } + + long ops(List enabledList, Map> providesMap) { + cmpOps = 0; + run(enabledList, providesMap); + return cmpOps; + } + } + + // ------------------------------------------------------------------------- + // Fast — HashSet built once before loop + // ------------------------------------------------------------------------- + + static class FastFeatureSelection { + long cmpOps = 0; + + int run(List enabledList, + Map> providesMap) { + Set enabledSet = new HashSet<>(enabledList); + cmpOps += enabledList.size(); // build cost + int conflicts = 0; + for (Map.Entry> entry : providesMap.entrySet()) { + for (String selectable : entry.getValue()) { + cmpOps++; + if (enabledSet.contains(selectable)) { + conflicts++; + } + } + } + return conflicts; + } + + long ops(List enabledList, Map> providesMap) { + cmpOps = 0; + run(enabledList, providesMap); + return cmpOps; + } + } + + // ------------------------------------------------------------------------- + // Build test data + // ------------------------------------------------------------------------- + + static List makeEnabledList(int l) { + List list = new ArrayList<>(); + for (int i = 0; i < l; i++) list.add("feature_" + i); + return list; + } + + static Map> makeProvidesMap(int p, int s, int overlapStart) { + Map> map = new LinkedHashMap<>(); + for (int i = 0; i < p; i++) { + List sels = new ArrayList<>(); + for (int j = 0; j < s; j++) { + // Some selectables are in enabledList (conflicts), some not + sels.add("feature_" + (overlapStart + i * s + j)); + } + map.put("provide_" + i, sels); + } + return map; + } + + public static void main(String[] args) { + SlowFeatureSelection slow = new SlowFeatureSelection(); + FastFeatureSelection fast = new FastFeatureSelection(); + + int passed = 0, total = 0; + + System.out.println("=== bazel-0003: FeatureSelection ImmutableList.contains O(P×S×L) ==="); + + // (L, P, S) configurations matching realistic Bazel C++ toolchain sizes + int[][] configs = { + {50, 7, 6}, // small toolchain + {80, 7, 6}, // realistic (agent's estimate) + {150, 10, 8}, // large toolchain + {300, 15, 10} // extreme + }; + for (int[] cfg : configs) { + int l = cfg[0], p = cfg[1], s = cfg[2]; + List enabled = makeEnabledList(l); + Map> provides = makeProvidesMap(p, s, 0); + + long sv = slow.ops(enabled, provides); + long fv = fast.ops(enabled, provides); + double ratio = (double) sv / Math.max(fv, 1); + + total++; + boolean ok = sv > fv && ratio >= 5.0; + System.out.printf("L=%3d P=%2d S=%2d slow=%7d fast=%5d ratio=%6.1fx %s%n", + l, p, s, sv, fv, ratio, ok ? "PASS" : "FAIL"); + if (ok) passed++; + } + + // Correctness: both count same conflicts + List enabled = makeEnabledList(80); + Map> provides = makeProvidesMap(7, 6, 0); + int sc = slow.run(enabled, provides); + int fc = fast.run(enabled, provides); + total++; + boolean correct = sc == fc; + System.out.printf("conflict count matches (%d): %s%n", sc, correct ? "PASS" : "FAIL"); + if (correct) passed++; + + System.out.printf("%n%d/%d PASS%n", passed, total); + if (passed < total) System.exit(1); + } +} diff --git a/defects/beam/patch/beam-CLEAN.md b/defects/beam/patch/beam-CLEAN.md index 39ddb4fac..1e019de62 100644 --- a/defects/beam/patch/beam-CLEAN.md +++ b/defects/beam/patch/beam-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000353 # beam — CLEAN Scanned: diff --git a/defects/binutils/patch/binutils-0001-unique-section-list.md b/defects/binutils/patch/binutils-0001-unique-section-list.md index 49e79f00f..253abfa9b 100644 --- a/defects/binutils/patch/binutils-0001-unique-section-list.md +++ b/defects/binutils/patch/binutils-0001-unique-section-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000354 # binutils-0001 — ldlang.c unique_section_p O(S×U) linked-list scan **Severity:** MEDIUM diff --git a/defects/bird/patch/bird-0003-community-set-union-hashset.md b/defects/bird/patch/bird-0003-community-set-union-hashset.md index 2f3972293..558a3e957 100644 --- a/defects/bird/patch/bird-0003-community-set-union-hashset.md +++ b/defects/bird/patch/bird-0003-community-set-union-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000355 # bird-0003: int_set_union / ec_set_union / lc_set_union O(N×M) → O(N+M) ## Classification diff --git a/defects/bird/patch/bird-0004-community-filter-hashset.md b/defects/bird/patch/bird-0004-community-filter-hashset.md index d9fae3786..25110ef56 100644 --- a/defects/bird/patch/bird-0004-community-filter-hashset.md +++ b/defects/bird/patch/bird-0004-community-filter-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000356 # bird-0004: clist_filter / eclist_filter / lclist_filter O(L×S) → O(L+S) ## Classification diff --git a/defects/bitcoin/patch/bitcoin-0001-mini-miner-delete-ancestor-linear-scan.md b/defects/bitcoin/patch/bitcoin-0001-mini-miner-delete-ancestor-linear-scan.md index d90a3eebe..20b3b49e1 100644 --- a/defects/bitcoin/patch/bitcoin-0001-mini-miner-delete-ancestor-linear-scan.md +++ b/defects/bitcoin/patch/bitcoin-0001-mini-miner-delete-ancestor-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000357 # bitcoin-0001: MiniMiner DeleteAncestorPackage O(A×E) std::find in Outer Loop ## Classification diff --git a/defects/buck2/patch/buck2-CLEAN.md b/defects/buck2/patch/buck2-CLEAN.md index 27c9e0675..53aea80a9 100644 --- a/defects/buck2/patch/buck2-CLEAN.md +++ b/defects/buck2/patch/buck2-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000358 ## Buck2 — CWE-407 Scan Result: CLEAN Scanned: `app/buck2_build_api/src/`, `app/buck2_query/src/`, `app/buck2_query_impls/src/`, diff --git a/defects/bun/patch/bun-0001-bin-folders-dedup-set.md b/defects/bun/patch/bun-0001-bin-folders-dedup-set.md index c9566455e..1495eceda 100644 --- a/defects/bun/patch/bun-0001-bin-folders-dedup-set.md +++ b/defects/bun/patch/bun-0001-bin-folders-dedup-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000359 # bun-0001 — CWE-407 in dirInfoUncached bin_folders dedup **Severity:** MEDIUM diff --git a/defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md b/defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md index f65e169dc..5f01fddf2 100644 --- a/defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md +++ b/defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000020 # Caddy matchers.go + upstreams.go — CWE-407 scan result: CLEAN ## Scan date: 2026-03-27 diff --git a/defects/camel/patch/camel-0001-route-startup-quadratic-endpoint-scan.md b/defects/camel/patch/camel-0001-route-startup-quadratic-endpoint-scan.md index fb188975a..94cc33a01 100644 --- a/defects/camel/patch/camel-0001-route-startup-quadratic-endpoint-scan.md +++ b/defects/camel/patch/camel-0001-route-startup-quadratic-endpoint-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000360 # camel-0001 — O(R²) Route Startup Endpoint Clash Scan **Severity:** HIGH diff --git a/defects/celery/patch/celery-0001-result-set-quadratic-membership.md b/defects/celery/patch/celery-0001-result-set-quadratic-membership.md index 1258d8552..ffe98d04f 100644 --- a/defects/celery/patch/celery-0001-result-set-quadratic-membership.md +++ b/defects/celery/patch/celery-0001-result-set-quadratic-membership.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000025 # celery-0001 — O(N²) ResultSet Membership Test in update()/add() **Severity:** MEDIUM diff --git a/defects/celery/patch/celery-0002-canvas-append-list-option-membership.md b/defects/celery/patch/celery-0002-canvas-append-list-option-membership.md index b747ef3a2..92b786004 100644 --- a/defects/celery/patch/celery-0002-canvas-append-list-option-membership.md +++ b/defects/celery/patch/celery-0002-canvas-append-list-option-membership.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000361 # cel-0001: canvas.py append_to_list_option O(N²) list membership in chain/chord build loops **Severity:** MEDIUM diff --git a/defects/ceph/patch/ceph-0001-osdmap-underfull-set.md b/defects/ceph/patch/ceph-0001-osdmap-underfull-set.md index 2a96fe703..0216c2b0b 100644 --- a/defects/ceph/patch/ceph-0001-osdmap-underfull-set.md +++ b/defects/ceph/patch/ceph-0001-osdmap-underfull-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000026 # ceph-0001 — `OSDMap::calc_pg_upmaps`: O(N×U) `std::find` on `underfull` vector inside OSD scan loop ## Status diff --git a/defects/chef/patch/chef-0001-run-list-array-include.md b/defects/chef/patch/chef-0001-run-list-array-include.md index af0984185..75b9fac89 100644 --- a/defects/chef/patch/chef-0001-run-list-array-include.md +++ b/defects/chef/patch/chef-0001-run-list-array-include.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000362 # chef-0001 — O(N²) run list dedup via Array#include? **Severity:** MEDIUM diff --git a/defects/cilium/patch/cilium-0002-l7-rule-dedup-quadratic.md b/defects/cilium/patch/cilium-0002-l7-rule-dedup-quadratic.md index f75d387b7..7eaa145d6 100644 --- a/defects/cilium/patch/cilium-0002-l7-rule-dedup-quadratic.md +++ b/defects/cilium/patch/cilium-0002-l7-rule-dedup-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000363 # cilium-0001: CWE-407 — Quadratic L7 rule deduplication during network policy merge ## Severity: MEDIUM diff --git a/defects/cilium/patch/cilium-0003-node-manager-ipaddress-linear-scan.md b/defects/cilium/patch/cilium-0003-node-manager-ipaddress-linear-scan.md index fd35586d0..3a31deccc 100644 --- a/defects/cilium/patch/cilium-0003-node-manager-ipaddress-linear-scan.md +++ b/defects/cilium/patch/cilium-0003-node-manager-ipaddress-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000364 # cilium-0003: CWE-407 — Quadratic IP address deduplication in node manager ## Severity: HIGH diff --git a/defects/cilium/patch/cilium-0004-bpf-cfg-predecessor-linear-scan.md b/defects/cilium/patch/cilium-0004-bpf-cfg-predecessor-linear-scan.md index 88960dda3..6845a71cf 100644 --- a/defects/cilium/patch/cilium-0004-bpf-cfg-predecessor-linear-scan.md +++ b/defects/cilium/patch/cilium-0004-bpf-cfg-predecessor-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000365 # cilium-0004: CWE-407 — Quadratic predecessor deduplication in eBPF CFG construction ## Severity: MEDIUM diff --git a/defects/clickhouse/patch/clickhouse-0001-storage-system-columns-find-in-vector.md b/defects/clickhouse/patch/clickhouse-0001-storage-system-columns-find-in-vector.md index 3b97f3719..3aa918edb 100644 --- a/defects/clickhouse/patch/clickhouse-0001-storage-system-columns-find-in-vector.md +++ b/defects/clickhouse/patch/clickhouse-0001-storage-system-columns-find-in-vector.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000031 # clickhouse-0001: StorageSystemColumns linear scan per column for key membership ## Severity diff --git a/defects/clojure/patch/clojure-CLEAN.md b/defects/clojure/patch/clojure-CLEAN.md index 53702ad59..a281863be 100644 --- a/defects/clojure/patch/clojure-CLEAN.md +++ b/defects/clojure/patch/clojure-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000366 # Clojure Compiler — CWE-407 Scan Result: CLEAN ## Files Scanned diff --git a/defects/consul/patch/consul-0001-checks-exclude.md b/defects/consul/patch/consul-0001-checks-exclude.md index 5810bdb27..a489b3ba1 100644 --- a/defects/consul/patch/consul-0001-checks-exclude.md +++ b/defects/consul/patch/consul-0001-checks-exclude.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000367 # consul-0001: ExcludeBasedOnChecks — O(checks × ignoreIDs) ## CWE diff --git a/defects/containerd/patch/containerd-0001-filter-caps-quadratic.md b/defects/containerd/patch/containerd-0001-filter-caps-quadratic.md index ed2bde02b..0da388117 100644 --- a/defects/containerd/patch/containerd-0001-filter-caps-quadratic.md +++ b/defects/containerd/patch/containerd-0001-filter-caps-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000368 # containerd-0001: filterCaps + WithAddedCapabilities O(n²) — capsContain inside loop ## Severity diff --git a/defects/crystal/patch/crystal-0001-compare-strictness-named-args.md b/defects/crystal/patch/crystal-0001-compare-strictness-named-args.md index d0c5779f8..58c9a2c7e 100644 --- a/defects/crystal/patch/crystal-0001-compare-strictness-named-args.md +++ b/defects/crystal/patch/crystal-0001-compare-strictness-named-args.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000369 # crystal-0001: compare_strictness — O(N²) named arg lookup in overload ordering ## Severity: HIGH diff --git a/defects/crystal/patch/crystal-0002-type-merge-add-type.md b/defects/crystal/patch/crystal-0002-type-merge-add-type.md index 49ee25f14..7b017f662 100644 --- a/defects/crystal/patch/crystal-0002-type-merge-add-type.md +++ b/defects/crystal/patch/crystal-0002-type-merge-add-type.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000370 # crystal-0002: type_merge add_type — O(N) includes? inside O(N) compact_types loop ## Severity: HIGH diff --git a/defects/crystal/patch/crystal-0003-non-nilable-outside.md b/defects/crystal/patch/crystal-0003-non-nilable-outside.md index c32402eec..a1c75ab52 100644 --- a/defects/crystal/patch/crystal-0003-non-nilable-outside.md +++ b/defects/crystal/patch/crystal-0003-non-nilable-outside.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000371 # crystal-0003: compute_non_nilable_outside_single — O(N) includes? in O(A) ancestor loop ## Severity: MEDIUM diff --git a/defects/crystal/patch/crystal-0004-add-to-including-types.md b/defects/crystal/patch/crystal-0004-add-to-including-types.md index 84ad7b84b..fed9495ef 100644 --- a/defects/crystal/patch/crystal-0004-add-to-including-types.md +++ b/defects/crystal/patch/crystal-0004-add-to-including-types.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000372 # crystal-0004: add_to_including_types — O(N²) Array#includes? in module instantiation loop ## Severity: MEDIUM diff --git a/defects/curl/patch/curl-CLEAN-altsvc-connect-cookie.md b/defects/curl/patch/curl-CLEAN-altsvc-connect-cookie.md index 3358597e8..57bffd518 100644 --- a/defects/curl/patch/curl-CLEAN-altsvc-connect-cookie.md +++ b/defects/curl/patch/curl-CLEAN-altsvc-connect-cookie.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000040 # curl CLEAN — altsvc, connect, cookie (CWE-407 scan) ## Files Analyzed diff --git a/defects/dart/patch/dart-0001-named-param-list-contains.md b/defects/dart/patch/dart-0001-named-param-list-contains.md index 19c7d4f93..72d9e5028 100644 --- a/defects/dart/patch/dart-0001-named-param-list-contains.md +++ b/defects/dart/patch/dart-0001-named-param-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000373 # dart-0001: forEachOrderedParameterByFunctionNode namedParameters List.contains() — O(N²) ## Severity diff --git a/defects/dart/patch/dart-0002-ssa-builder-named-param-where.md b/defects/dart/patch/dart-0002-ssa-builder-named-param-where.md index 4daf86cc1..7feae28e7 100644 --- a/defects/dart/patch/dart-0002-ssa-builder-named-param-where.md +++ b/defects/dart/patch/dart-0002-ssa-builder-named-param-where.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000374 # dart-0002: SSA builder namedParameters.contains() in .where() filter — O(N²) ## Severity diff --git a/defects/dart/patch/dart-0003-ssa-builder-named-param-where-2.md b/defects/dart/patch/dart-0003-ssa-builder-named-param-where-2.md index 2f4b6d1ad..9336dc8e8 100644 --- a/defects/dart/patch/dart-0003-ssa-builder-named-param-where-2.md +++ b/defects/dart/patch/dart-0003-ssa-builder-named-param-where-2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000375 # dart-0003: SSA builder namedParameters.contains() in argument ordering — O(N²) ## Severity diff --git a/defects/deno/patch/deno-CLEAN.md b/defects/deno/patch/deno-CLEAN.md index b28427a0a..c2a2325f3 100644 --- a/defects/deno/patch/deno-CLEAN.md +++ b/defects/deno/patch/deno-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000376 # deno — CLEAN **Scanned:** 2026-03-27 diff --git a/defects/dgraph/patch/dgraph-0001-shortest-path-route-indexOf.md b/defects/dgraph/patch/dgraph-0001-shortest-path-route-indexOf.md index 74a7c9f46..7be9ae126 100644 --- a/defects/dgraph/patch/dgraph-0001-shortest-path-route-indexOf.md +++ b/defects/dgraph/patch/dgraph-0001-shortest-path-route-indexOf.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000377 # dgraph-0001: CWE-407 O(P) route cycle-check inside hot BFS/Dijkstra neighbour loop **Severity:** HIGH diff --git a/defects/django/patch/django-0005-alt-constraints-name-set.md b/defects/django/patch/django-0005-alt-constraints-name-set.md index 6ab7d806d..b7c0b2572 100644 --- a/defects/django/patch/django-0005-alt-constraints-name-set.md +++ b/defects/django/patch/django-0005-alt-constraints-name-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000378 # django-0005: alt_constraints_name list → set in create_altered_constraints() ## Severity diff --git a/defects/django/patch/django-0006-remove-from-added-set.md b/defects/django/patch/django-0006-remove-from-added-set.md index 80c59a581..1f6a09007 100644 --- a/defects/django/patch/django-0006-remove-from-added-set.md +++ b/defects/django/patch/django-0006-remove-from-added-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000379 # django-0006: remove_from_added / remove_from_removed lists → sets in create_altered_indexes() ## Severity diff --git a/defects/doris/patch/doris-0001-bind-expr-grouping-list-contains.md b/defects/doris/patch/doris-0001-bind-expr-grouping-list-contains.md index 1ca432ac6..bcf7b4a2b 100644 --- a/defects/doris/patch/doris-0001-bind-expr-grouping-list-contains.md +++ b/defects/doris/patch/doris-0001-bind-expr-grouping-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000381 # doris-0001: BindExpression.processNonStandardAggregate — List.contains per projection → O(P×G) ## Classification diff --git a/defects/dragonfly/patch/dragonfly-0001-missing-migrations-hashset.md b/defects/dragonfly/patch/dragonfly-0001-missing-migrations-hashset.md index ef19a8899..426857d50 100644 --- a/defects/dragonfly/patch/dragonfly-0001-missing-migrations-hashset.md +++ b/defects/dragonfly/patch/dragonfly-0001-missing-migrations-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000382 # dragonfly-0001: GetMissingMigrations O(M²) std::find → O(M log M) set_difference ## Classification diff --git a/defects/druid/patch/druid-0001-scan-query-columns-list-contains.md b/defects/druid/patch/druid-0001-scan-query-columns-list-contains.md index 7e37dc886..767c99508 100644 --- a/defects/druid/patch/druid-0001-scan-query-columns-list-contains.md +++ b/defects/druid/patch/druid-0001-scan-query-columns-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000383 # druid-0001: ScanQuery columns List.contains in orderBy validation loop ## Severity diff --git a/defects/eclipse-jdt/patch/eclipse-jdt-0001-minimal-erased-candidates.md b/defects/eclipse-jdt/patch/eclipse-jdt-0001-minimal-erased-candidates.md index c637a685c..f206ca673 100644 --- a/defects/eclipse-jdt/patch/eclipse-jdt-0001-minimal-erased-candidates.md +++ b/defects/eclipse-jdt/patch/eclipse-jdt-0001-minimal-erased-candidates.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000384 # eclipse-jdt-0001: minimalErasedCandidates BFS work-queue ArrayList.contains O(N²) **CWE-407** — Inefficient Algorithmic Complexity diff --git a/defects/elasticsearch/patch/elasticsearch-001-mmr-diversification-list-contains.md b/defects/elasticsearch/patch/elasticsearch-001-mmr-diversification-list-contains.md index 2942d2a77..92ed5a87a 100644 --- a/defects/elasticsearch/patch/elasticsearch-001-mmr-diversification-list-contains.md +++ b/defects/elasticsearch/patch/elasticsearch-001-mmr-diversification-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000385 # elasticsearch-001: MMRResultDiversification O(n²) selectedDocRanks.contains ## Classification diff --git a/defects/elasticsearch/patch/elasticsearch-002-ingest-document-append-list-contains.md b/defects/elasticsearch/patch/elasticsearch-002-ingest-document-append-list-contains.md index 41324b658..1ac8c9f16 100644 --- a/defects/elasticsearch/patch/elasticsearch-002-ingest-document-append-list-contains.md +++ b/defects/elasticsearch/patch/elasticsearch-002-ingest-document-append-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000385 # elasticsearch-002: IngestDocument appendValues O(n²) list.contains ## Classification diff --git a/defects/elasticsearch/patch/elasticsearch-003-xcontent-helper-merge-list-contains.md b/defects/elasticsearch/patch/elasticsearch-003-xcontent-helper-merge-list-contains.md index 13b6aec96..1f7cb8b7e 100644 --- a/defects/elasticsearch/patch/elasticsearch-003-xcontent-helper-merge-list-contains.md +++ b/defects/elasticsearch/patch/elasticsearch-003-xcontent-helper-merge-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000385 # elasticsearch-003: XContentHelper O(n²) mergedList.contains in list dedup merge ## Classification diff --git a/defects/elasticsearch/patch/elasticsearch-004-index-graveyard-dangling-list-contains.md b/defects/elasticsearch/patch/elasticsearch-004-index-graveyard-dangling-list-contains.md index cacff7c31..0015b7011 100644 --- a/defects/elasticsearch/patch/elasticsearch-004-index-graveyard-dangling-list-contains.md +++ b/defects/elasticsearch/patch/elasticsearch-004-index-graveyard-dangling-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000385 # elasticsearch-004: IndexGraveyard.containsIndex O(n²) List scan in DanglingIndicesState loop ## Classification diff --git a/defects/elixir/patch/elixir-0001-mix-topological-sort.md b/defects/elixir/patch/elixir-0001-mix-topological-sort.md index 957aa8227..3a241aeab 100644 --- a/defects/elixir/patch/elixir-0001-mix-topological-sort.md +++ b/defects/elixir/patch/elixir-0001-mix-topological-sort.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000387 # elixir-0001: Mix.Dep.Converger.topological_sort — O(N²) Enum.find in Enum.map ## Severity: HIGH diff --git a/defects/emacs/patch/emacs-0001-fontset-info-fmember.md b/defects/emacs/patch/emacs-0001-fontset-info-fmember.md index 7f1f3c9c6..02158398f 100644 --- a/defects/emacs/patch/emacs-0001-fontset-info-fmember.md +++ b/defects/emacs/patch/emacs-0001-fontset-info-fmember.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000388 # emacs-0001: Ffontset_info Fmember dedup O(R×F×N) — MEDIUM ## Summary diff --git a/defects/emacs/patch/emacs-0002-bytecomp-code-strings-member.md b/defects/emacs/patch/emacs-0002-bytecomp-code-strings-member.md index 47b319a40..467cbdf99 100644 --- a/defects/emacs/patch/emacs-0002-bytecomp-code-strings-member.md +++ b/defects/emacs/patch/emacs-0002-bytecomp-code-strings-member.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000389 # emacs-0002: bytecomp--code-strings member O(F²) per file — MEDIUM ## Summary diff --git a/defects/envoy/patch/envoy-0002-ext-proc-namespace-linear-scan.md b/defects/envoy/patch/envoy-0002-ext-proc-namespace-linear-scan.md index c08a5bc46..c5e8a0454 100644 --- a/defects/envoy/patch/envoy-0002-ext-proc-namespace-linear-scan.md +++ b/defects/envoy/patch/envoy-0002-ext-proc-namespace-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000390 # envoy-0001: CWE-407 — Linear namespace membership scan on every ext_proc response, per-request ## Severity: HIGH diff --git a/defects/envoy/patch/envoy-0003-eds-host-merge-linear-scan.md b/defects/envoy/patch/envoy-0003-eds-host-merge-linear-scan.md index 1b7a0a696..53229122d 100644 --- a/defects/envoy/patch/envoy-0003-eds-host-merge-linear-scan.md +++ b/defects/envoy/patch/envoy-0003-eds-host-merge-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000391 # envoy-0003: CWE-407 — O(H×R) linear scan during EDS host batch merge ## Severity: MEDIUM diff --git a/defects/etcd/patch/etcd-CLEAN.md b/defects/etcd/patch/etcd-CLEAN.md index a29fdd395..5f6e68511 100644 --- a/defects/etcd/patch/etcd-CLEAN.md +++ b/defects/etcd/patch/etcd-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000392 # etcd CWE-407 Scan — CLEAN **Date:** 2026-03-27 diff --git a/defects/etcd/patch/etcd-deeper-CLEAN.md b/defects/etcd/patch/etcd-deeper-CLEAN.md index 6bd6cd580..93144b893 100644 --- a/defects/etcd/patch/etcd-deeper-CLEAN.md +++ b/defects/etcd/patch/etcd-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000392 # etcd CWE-407 Deeper Scan — CLEAN **Date:** 2026-03-27 diff --git a/defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md b/defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md index 8bafc02fc..70521d203 100644 --- a/defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md +++ b/defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000070 # FFmpeg deeper scan — CWE-407 CLEAN (libavcodec/libavfilter/libavformat) ## Files scanned diff --git a/defects/fish/patch/fish-CLEAN.md b/defects/fish/patch/fish-CLEAN.md index 26380e84b..2dd336cc3 100644 --- a/defects/fish/patch/fish-CLEAN.md +++ b/defects/fish/patch/fish-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000394 # fish — CLEAN ## Scan Date diff --git a/defects/flink/patch/flink-0002-rowtypeutils-checklist-hashset.md b/defects/flink/patch/flink-0002-rowtypeutils-checklist-hashset.md index 7584ea041..24585694f 100644 --- a/defects/flink/patch/flink-0002-rowtypeutils-checklist-hashset.md +++ b/defects/flink/patch/flink-0002-rowtypeutils-checklist-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000395 # flink-0002: RowTypeUtils.getUniqueName — List.contains() inside nested for+do-while ## Defect ID diff --git a/defects/flink/patch/flink-0003-aggregatereducegroupingrule-newgroupinglist-hashset.md b/defects/flink/patch/flink-0003-aggregatereducegroupingrule-newgroupinglist-hashset.md index d1d351375..0e2ea7b02 100644 --- a/defects/flink/patch/flink-0003-aggregatereducegroupingrule-newgroupinglist-hashset.md +++ b/defects/flink/patch/flink-0003-aggregatereducegroupingrule-newgroupinglist-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000396 # flink-0003: AggregateReduceGroupingRule — List.contains() inside for loop ## Defect ID diff --git a/defects/flink/patch/flink-0004-dynamicsinkutils-updatedcolumns-hashmap.md b/defects/flink/patch/flink-0004-dynamicsinkutils-updatedcolumns-hashmap.md index d9d43c2d0..748403e97 100644 --- a/defects/flink/patch/flink-0004-dynamicsinkutils-updatedcolumns-hashmap.md +++ b/defects/flink/patch/flink-0004-dynamicsinkutils-updatedcolumns-hashmap.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000397 # flink-0004: DynamicSinkUtils UPDATE column resolution O(C×U) → O(C+U) ## Location diff --git a/defects/flink/patch/flink-0005-dynamicpartitionpruning-fieldnames-indexof-hashmap.md b/defects/flink/patch/flink-0005-dynamicpartitionpruning-fieldnames-indexof-hashmap.md index 68990936d..c1ac73a5d 100644 --- a/defects/flink/patch/flink-0005-dynamicpartitionpruning-fieldnames-indexof-hashmap.md +++ b/defects/flink/patch/flink-0005-dynamicpartitionpruning-fieldnames-indexof-hashmap.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000398 # flink-0005: DynamicPartitionPruningUtils — List.indexOf + List.contains O(A×F + K×A) → O(F + K) ## Metadata diff --git a/defects/flink/patch/flink-deeper-CLEAN.md b/defects/flink/patch/flink-deeper-CLEAN.md index 5a8bc5f58..589b9c652 100644 --- a/defects/flink/patch/flink-deeper-CLEAN.md +++ b/defects/flink/patch/flink-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000072 # flink-deeper — PipelinedRegionSchedulingStrategy + EdgeManagerBuildUtil CLEAN ## Files Scanned diff --git a/defects/flutter/patch/flutter-scan-notes.md b/defects/flutter/patch/flutter-scan-notes.md index 5b32629c3..e7b902432 100644 --- a/defects/flutter/patch/flutter-scan-notes.md +++ b/defects/flutter/patch/flutter-scan-notes.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000399 # Flutter CWE-407 Scan — CLEAN ## Date diff --git a/defects/foundationdb/patch/foundationdb-0001-canlauncsrc-std-count-nested-loop.md b/defects/foundationdb/patch/foundationdb-0001-canlauncsrc-std-count-nested-loop.md index b1433d586..4cd887bfb 100644 --- a/defects/foundationdb/patch/foundationdb-0001-canlauncsrc-std-count-nested-loop.md +++ b/defects/foundationdb/patch/foundationdb-0001-canlauncsrc-std-count-nested-loop.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000400 # foundationdb-0001 — canLaunchSrc: std::count nested inside O(S×R) double loop **Project:** FoundationDB diff --git a/defects/frrouting/patch/frrouting-0003-community-uniq-sort-dedup.md b/defects/frrouting/patch/frrouting-0003-community-uniq-sort-dedup.md index 0293d4ce8..d69fcd756 100644 --- a/defects/frrouting/patch/frrouting-0003-community-uniq-sort-dedup.md +++ b/defects/frrouting/patch/frrouting-0003-community-uniq-sort-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000401 # frrouting-0003: community_uniq_sort O(N²) → O(N log N) sort+dedup ## Classification diff --git a/defects/frrouting/patch/frrouting-0004-ecommunity-include-merge.md b/defects/frrouting/patch/frrouting-0004-ecommunity-include-merge.md index b731b1490..d987a3391 100644 --- a/defects/frrouting/patch/frrouting-0004-ecommunity-include-merge.md +++ b/defects/frrouting/patch/frrouting-0004-ecommunity-include-merge.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000402 # frrouting-0004: ecommunity_include O(E1×E2) → O(E1+E2) merge-intersection ## Classification diff --git a/defects/gdb/patch/gdb-CLEAN.md b/defects/gdb/patch/gdb-CLEAN.md index fc27cdb95..bbe82aa77 100644 --- a/defects/gdb/patch/gdb-CLEAN.md +++ b/defects/gdb/patch/gdb-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000403 # GDB — CWE-407 Scan Result: CLEAN **Date:** 2026-03-27 diff --git a/defects/glib/patch/glib-CLEAN.md b/defects/glib/patch/glib-CLEAN.md index e67b82526..0f7e21ea5 100644 --- a/defects/glib/patch/glib-CLEAN.md +++ b/defects/glib/patch/glib-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000404 # GLib — CWE-407 scan CLEAN ## Files scanned diff --git a/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md b/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md index 0069bf504..e4a0ac286 100644 --- a/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md +++ b/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000081 # go-stdlib-0001 — net/http/internal/http2: rfc9218Priority allocates []string per header field **Severity:** MEDIUM diff --git a/defects/go/patch/go-stdlib-deeper-CLEAN.md b/defects/go/patch/go-stdlib-deeper-CLEAN.md index aed84d9bc..0d6cd12e9 100644 --- a/defects/go/patch/go-stdlib-deeper-CLEAN.md +++ b/defects/go/patch/go-stdlib-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000081 # go-stdlib deeper scan — CLEAN **Scan date:** 2026-03-27 diff --git a/defects/graal/patch/graal-deeper-CLEAN.md b/defects/graal/patch/graal-deeper-CLEAN.md index 2a5af94c9..5081c5a86 100644 --- a/defects/graal/patch/graal-deeper-CLEAN.md +++ b/defects/graal/patch/graal-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000405 # GraalVM CWE-407 Scan — CLEAN **Repo:** `https://github.com/oracle/graal` (depth=1, tag: main) diff --git a/defects/grafana/patch/grafana-0002-folder-permission-dedup.md b/defects/grafana/patch/grafana-0002-folder-permission-dedup.md index 5c516812a..fee2df24b 100644 --- a/defects/grafana/patch/grafana-0002-folder-permission-dedup.md +++ b/defects/grafana/patch/grafana-0002-folder-permission-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000406 # grafana-0002: Folder/dashboard permission UID deduplication O(P²) **CWE:** CWE-407 (Algorithmic Complexity — Inefficient Algorithmic Complexity) diff --git a/defects/graphhopper/patch/graphhopper-0001-alternative-route-ch-nodes-contains.md b/defects/graphhopper/patch/graphhopper-0001-alternative-route-ch-nodes-contains.md index 0d44c6f3f..25d0f595b 100644 --- a/defects/graphhopper/patch/graphhopper-0001-alternative-route-ch-nodes-contains.md +++ b/defects/graphhopper/patch/graphhopper-0001-alternative-route-ch-nodes-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000407 # graphhopper-0001: AlternativeRouteCH — IntArrayList.contains() O(P) inside edge loop ## File diff --git a/defects/graphhopper/patch/graphhopper-0002-alternative-route-edge-ch-nodes-contains.md b/defects/graphhopper/patch/graphhopper-0002-alternative-route-edge-ch-nodes-contains.md index 477cfb147..81eb4d2ff 100644 --- a/defects/graphhopper/patch/graphhopper-0002-alternative-route-edge-ch-nodes-contains.md +++ b/defects/graphhopper/patch/graphhopper-0002-alternative-route-edge-ch-nodes-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000408 # graphhopper-0002: AlternativeRouteEdgeCH — IntArrayList.contains() O(P) inside edge loop ## File diff --git a/defects/groovy/patch/groovy-0001-named-params-collector-list.md b/defects/groovy/patch/groovy-0001-named-params-collector-list.md index 87fa36745..823e48dd1 100644 --- a/defects/groovy/patch/groovy-0001-named-params-collector-list.md +++ b/defects/groovy/patch/groovy-0001-named-params-collector-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000409 # groovy-0001 — StaticTypeCheckingVisitor: `collectedNames` ArrayList linear scan O(E×C) ## Classification diff --git a/defects/groovy/patch/groovy-0002-verifier-default-params-arraylist-contains.md b/defects/groovy/patch/groovy-0002-verifier-default-params-arraylist-contains.md index d4c0a129d..8ce36bc64 100644 --- a/defects/groovy/patch/groovy-0002-verifier-default-params-arraylist-contains.md +++ b/defects/groovy/patch/groovy-0002-verifier-default-params-arraylist-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000410 # groovy-0002 — Verifier: `Arrays.asList(params).contains(p)` fresh allocation per variable expression O(V×P) ## Classification diff --git a/defects/grpc/patch/grpc-0001-channelz-property-grid-vector-find-o-n2.md b/defects/grpc/patch/grpc-0001-channelz-property-grid-vector-find-o-n2.md index 805f9f521..d155b67d2 100644 --- a/defects/grpc/patch/grpc-0001-channelz-property-grid-vector-find-o-n2.md +++ b/defects/grpc/patch/grpc-0001-channelz-property-grid-vector-find-o-n2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000411 # grpc-0001: channelz PropertyGrid/PropertyTable GetIndex() std::find O(C²) → O(1) with absl::flat_hash_map ## File diff --git a/defects/gunicorn/patch/gunicorn-CLEAN.md b/defects/gunicorn/patch/gunicorn-CLEAN.md index 6038f8430..7e6e4364c 100644 --- a/defects/gunicorn/patch/gunicorn-CLEAN.md +++ b/defects/gunicorn/patch/gunicorn-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000412 # gunicorn — CWE-407 Scan: CLEAN **Date:** 2026-03-27 diff --git a/defects/hadoop/patch/hadoop-0001-ticket.md b/defects/hadoop/patch/hadoop-0001-ticket.md index 87ed1ec9e..87b20f593 100644 --- a/defects/hadoop/patch/hadoop-0001-ticket.md +++ b/defects/hadoop/patch/hadoop-0001-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000096 # hadoop-0001: PendingReconstructionBlocks — ArrayList.contains() O(n²) in incrementReplicas() ## Severity diff --git a/defects/hadoop/patch/hadoop-0002-ticket.md b/defects/hadoop/patch/hadoop-0002-ticket.md index 34eec10e2..70b4e1fc4 100644 --- a/defects/hadoop/patch/hadoop-0002-ticket.md +++ b/defects/hadoop/patch/hadoop-0002-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000097 # hadoop-0002: HeartbeatManager — ArrayList.contains() O(n²) in heartbeat check loop ## Severity diff --git a/defects/hadoop/patch/hadoop-0003-ticket.md b/defects/hadoop/patch/hadoop-0003-ticket.md index 2aafbe4ad..672746a1f 100644 --- a/defects/hadoop/patch/hadoop-0003-ticket.md +++ b/defects/hadoop/patch/hadoop-0003-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000098 # hadoop-0003: StoragePolicySatisfier — ArrayList.contains() O(n²) in block placement loop ## Severity diff --git a/defects/hadoop/patch/hadoop-0004-ticket.md b/defects/hadoop/patch/hadoop-0004-ticket.md index 148f6220f..3981ab155 100644 --- a/defects/hadoop/patch/hadoop-0004-ticket.md +++ b/defects/hadoop/patch/hadoop-0004-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000099 # hadoop-0004: HDFS Balancer Dispatcher — srcBlocks ArrayList.contains() O(n²) in block receive loop ## Severity diff --git a/defects/haproxy/patch/haproxy-0002-flt-spoe-duplicate-detection.md b/defects/haproxy/patch/haproxy-0002-flt-spoe-duplicate-detection.md index d968033cc..ba6860ca9 100644 --- a/defects/haproxy/patch/haproxy-0002-flt-spoe-duplicate-detection.md +++ b/defects/haproxy/patch/haproxy-0002-flt-spoe-duplicate-detection.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000413 # haproxy-0002 — flt_spoe.c SPOE message/group duplicate detection O(N²) ## Ecosystem diff --git a/defects/haproxy/patch/haproxy-0003-spoe-check-config-resolution-O-N2.md b/defects/haproxy/patch/haproxy-0003-spoe-check-config-resolution-O-N2.md index c1d840ff1..256a5d91b 100644 --- a/defects/haproxy/patch/haproxy-0003-spoe-check-config-resolution-O-N2.md +++ b/defects/haproxy/patch/haproxy-0003-spoe-check-config-resolution-O-N2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000414 # haproxy-0003 — flt_spoe.c spoe_check_config O(P×M), O(P×G), O(G×P×M) resolution loops ## Ecosystem diff --git a/defects/hazelcast/patch/hazelcast-0001-queue-compare-and-remove.md b/defects/hazelcast/patch/hazelcast-0001-queue-compare-and-remove.md index 694a70969..7508ab121 100644 --- a/defects/hazelcast/patch/hazelcast-0001-queue-compare-and-remove.md +++ b/defects/hazelcast/patch/hazelcast-0001-queue-compare-and-remove.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000415 # hazelcast-0001 — QueueContainer.compareAndRemove() O(Q×D) membership test ## Classification diff --git a/defects/hazelcast/patch/hazelcast-0002-queue-contains-all.md b/defects/hazelcast/patch/hazelcast-0002-queue-contains-all.md index c2d77a3ff..aab848111 100644 --- a/defects/hazelcast/patch/hazelcast-0002-queue-contains-all.md +++ b/defects/hazelcast/patch/hazelcast-0002-queue-contains-all.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000416 # hazelcast-0002 — QueueContainer.contains() O(D×Q) nested scan ## Classification diff --git a/defects/hbase/patch/hbase-0001-ticket.md b/defects/hbase/patch/hbase-0001-ticket.md index 2cc1e2c4e..cbdf4b592 100644 --- a/defects/hbase/patch/hbase-0001-ticket.md +++ b/defects/hbase/patch/hbase-0001-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000102 # hbase-0001: DefaultStoreFileManager — ArrayList.contains() O(n²) in getUnneededFiles() ## Severity diff --git a/defects/hbase/patch/hbase-0002-ticket.md b/defects/hbase/patch/hbase-0002-ticket.md index 22d1f58ac..5c9705840 100644 --- a/defects/hbase/patch/hbase-0002-ticket.md +++ b/defects/hbase/patch/hbase-0002-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000103 # hbase-0002: BaseLoadBalancer.randomAssignment — usedSNs ArrayList.contains() O(n²) in assignment loop ## Severity diff --git a/defects/helm/patch/helm-0002-filter-releases-plugins-set.md b/defects/helm/patch/helm-0002-filter-releases-plugins-set.md index 140985362..7bd16f795 100644 --- a/defects/helm/patch/helm-0002-filter-releases-plugins-set.md +++ b/defects/helm/patch/helm-0002-filter-releases-plugins-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000105 # helm-0002: filterReleases / filterPlugins — O(n×m) linear membership in filter loops **Severity:** MEDIUM diff --git a/defects/helm/patch/helm-0003-repo-update-linear-scan.md b/defects/helm/patch/helm-0003-repo-update-linear-scan.md index bbdad82e6..4d5b2cbeb 100644 --- a/defects/helm/patch/helm-0003-repo-update-linear-scan.md +++ b/defects/helm/patch/helm-0003-repo-update-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000106 # helm-0003: checkRequestedRepos / isRepoRequested — O(n×m) nested linear scan in repo update **Severity:** MEDIUM diff --git a/defects/hibernate/patch/hibernate-0006-persister-alias-closure-hashset.md b/defects/hibernate/patch/hibernate-0006-persister-alias-closure-hashset.md index d118b3b81..373009b4f 100644 --- a/defects/hibernate/patch/hibernate-0006-persister-alias-closure-hashset.md +++ b/defects/hibernate/patch/hibernate-0006-persister-alias-closure-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000401 +# UNDF: UNDF-2026-000000417 # hibernate-0006: AbstractEntityPersister — O(T²) alias dedup in subclass property closure ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/hibernate/patch/hibernate-deeper-CLEAN.md b/defects/hibernate/patch/hibernate-deeper-CLEAN.md index 10b832cfa..f8fdc07de 100644 --- a/defects/hibernate/patch/hibernate-deeper-CLEAN.md +++ b/defects/hibernate/patch/hibernate-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000107 # Hibernate ORM — Deeper CWE-407 Scan CLEAN Report ## Scan Date diff --git a/defects/httpd/patch/httpd-0002-proxy-noproxy-dirconn-dedup.md b/defects/httpd/patch/httpd-0002-proxy-noproxy-dirconn-dedup.md index 7bd19b14c..7ef894bce 100644 --- a/defects/httpd/patch/httpd-0002-proxy-noproxy-dirconn-dedup.md +++ b/defects/httpd/patch/httpd-0002-proxy-noproxy-dirconn-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000418 # httpd-0002 — mod_proxy NoProxy/DirectConnect config-parse O(N²) dedup ## Metadata diff --git a/defects/httpd/patch/httpd-0003-ssl-cipher-renegotiate-hashset.md b/defects/httpd/patch/httpd-0003-ssl-cipher-renegotiate-hashset.md index 5abb9f882..9d46945df 100644 --- a/defects/httpd/patch/httpd-0003-ssl-cipher-renegotiate-hashset.md +++ b/defects/httpd/patch/httpd-0003-ssl-cipher-renegotiate-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000419 # httpd-0003: ssl_hook_Access_classic cipher set comparison O(N×M) → O(N+M) ## Classification diff --git a/defects/httpd/patch/httpd-0004-proxy-route-worker-hashmap.md b/defects/httpd/patch/httpd-0004-proxy-route-worker-hashmap.md index 85d31a7f3..5f17a866d 100644 --- a/defects/httpd/patch/httpd-0004-proxy-route-worker-hashmap.md +++ b/defects/httpd/patch/httpd-0004-proxy-route-worker-hashmap.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000420 # httpd-0004: find_route_worker redirect chain O(N²) → O(N) with route hash map ## Classification diff --git a/defects/hudi/patch/hudi-0001-appendloadedinstants-list-contains.md b/defects/hudi/patch/hudi-0001-appendloadedinstants-list-contains.md index 4add6c870..067bb3bd2 100644 --- a/defects/hudi/patch/hudi-0001-appendloadedinstants-list-contains.md +++ b/defects/hudi/patch/hudi-0001-appendloadedinstants-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000421 # hudi-0001 — BaseHoodieTimeline.appendLoadedInstants List.contains O(N×M) ## File diff --git a/defects/hudi/patch/hudi-0002-pruneinternalschema-list-contains.md b/defects/hudi/patch/hudi-0002-pruneinternalschema-list-contains.md index f9745dca6..6c0348152 100644 --- a/defects/hudi/patch/hudi-0002-pruneinternalschema-list-contains.md +++ b/defects/hudi/patch/hudi-0002-pruneinternalschema-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000422 # hudi-0002 — InternalSchemaUtils.pruneInternalSchema ArrayList.contains O(N²) + pruneType O(F×D) ## File diff --git a/defects/hudi/patch/hudi-0003-metadatautil-logfilepaths-list-contains.md b/defects/hudi/patch/hudi-0003-metadatautil-logfilepaths-list-contains.md index 8daf27680..a1e03a6c9 100644 --- a/defects/hudi/patch/hudi-0003-metadatautil-logfilepaths-list-contains.md +++ b/defects/hudi/patch/hudi-0003-metadatautil-logfilepaths-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000423 # hudi-0003 — HoodieTableMetadataUtil.getRevivedAndDeletedKeysFromMergedLogs List.contains O(N×M) ## File diff --git a/defects/hypercorn/patch/hypercorn-CLEAN.md b/defects/hypercorn/patch/hypercorn-CLEAN.md index 3beac4e2f..cc6bfd391 100644 --- a/defects/hypercorn/patch/hypercorn-CLEAN.md +++ b/defects/hypercorn/patch/hypercorn-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000424 # hypercorn — CWE-407 Scan: CLEAN **Date:** 2026-03-27 diff --git a/defects/iceberg/patch/iceberg-0001-schemaupdate-applychanges-list-deletes.md b/defects/iceberg/patch/iceberg-0001-schemaupdate-applychanges-list-deletes.md index 60c075d0e..5d1a215af 100644 --- a/defects/iceberg/patch/iceberg-0001-schemaupdate-applychanges-list-deletes.md +++ b/defects/iceberg/patch/iceberg-0001-schemaupdate-applychanges-list-deletes.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000425 # iceberg-0001 — SchemaUpdate.ApplyChanges List deletes O(F×D) ## File diff --git a/defects/intellij/patch/intellij-CLEAN.md b/defects/intellij/patch/intellij-CLEAN.md index c7ccc5e3e..6702bde86 100644 --- a/defects/intellij/patch/intellij-CLEAN.md +++ b/defects/intellij/patch/intellij-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000426 # IntelliJ IDEA Community — CWE-407 Scan Result: INCOMPLETE / CLEAN (platform only) **Status:** CLEAN (for available modules) diff --git a/defects/istio/patch/istio-0002-push-context-gateway-linear-scan.md b/defects/istio/patch/istio-0002-push-context-gateway-linear-scan.md index d75bfa5ba..d840e8060 100644 --- a/defects/istio/patch/istio-0002-push-context-gateway-linear-scan.md +++ b/defects/istio/patch/istio-0002-push-context-gateway-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000427 # istio-0001: CWE-407 — Linear gateway membership scan inside VirtualService reconciliation loop ## Severity: HIGH diff --git a/defects/istio/patch/istio-0003-filter-chain-appproto-linear-scan.md b/defects/istio/patch/istio-0003-filter-chain-appproto-linear-scan.md index 794e5e380..c9bdce0a6 100644 --- a/defects/istio/patch/istio-0003-filter-chain-appproto-linear-scan.md +++ b/defects/istio/patch/istio-0003-filter-chain-appproto-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000428 # istio-0003: CWE-407 — O(FC×P×M×A) linear protocol scan in filterChainMatch during xDS push ## Severity: MEDIUM diff --git a/defects/janusgraph/patch/janusgraph-0001-multicondition-arraylist-contains.md b/defects/janusgraph/patch/janusgraph-0001-multicondition-arraylist-contains.md index d055185e4..9c5713993 100644 --- a/defects/janusgraph/patch/janusgraph-0001-multicondition-arraylist-contains.md +++ b/defects/janusgraph/patch/janusgraph-0001-multicondition-arraylist-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000430 # janusgraph-0001: MultiCondition extends ArrayList — O(C²) condition deduplication in query builder ## Severity diff --git a/defects/jax/patch/jax-0001-pallas-fuser-invars-linear-search.md b/defects/jax/patch/jax-0001-pallas-fuser-invars-linear-search.md index 49f5f9552..930d8d4d7 100644 --- a/defects/jax/patch/jax-0001-pallas-fuser-invars-linear-search.md +++ b/defects/jax/patch/jax-0001-pallas-fuser-invars-linear-search.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000431 # jax-0001 — pallas/fuser/jaxpr_fusion.py O(G × I × F) kernel fusion membership test ## Location diff --git a/defects/jetty/patch/jetty-CLEAN.md b/defects/jetty/patch/jetty-CLEAN.md index 70202c1e5..640a2758f 100644 --- a/defects/jetty/patch/jetty-CLEAN.md +++ b/defects/jetty/patch/jetty-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000126 ## Jetty — CWE-407 scan result: CLEAN (beyond jetty-0001) Files scanned: diff --git a/defects/jsc/patch/jsc-0001-bytecodebasicblock-switch-hashset.md b/defects/jsc/patch/jsc-0001-bytecodebasicblock-switch-hashset.md index 93de2e830..125e04d2c 100644 --- a/defects/jsc/patch/jsc-0001-bytecodebasicblock-switch-hashset.md +++ b/defects/jsc/patch/jsc-0001-bytecodebasicblock-switch-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000433 # JSC-0001: BytecodeBasicBlock::computeImpl() O(B²×T) edge linking via Vector::contains **File:** `Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp` diff --git a/defects/jsc/patch/jsc-0002-dfggraph-predecessor-hashset.md b/defects/jsc/patch/jsc-0002-dfggraph-predecessor-hashset.md index 3b3280149..8cb22fdf7 100644 --- a/defects/jsc/patch/jsc-0002-dfggraph-predecessor-hashset.md +++ b/defects/jsc/patch/jsc-0002-dfggraph-predecessor-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000434 # JSC-0002: DFGGraph::handleSuccessor() O(E×P) predecessor deduplication via Vector::contains **File:** `Source/JavaScriptCore/dfg/DFGGraph.cpp` diff --git a/defects/kafka/patch/kafka-0004-roundrobin-assignor-topics-hashset.md b/defects/kafka/patch/kafka-0004-roundrobin-assignor-topics-hashset.md index 36e8c076e..4df1dd7e9 100644 --- a/defects/kafka/patch/kafka-0004-roundrobin-assignor-topics-hashset.md +++ b/defects/kafka/patch/kafka-0004-roundrobin-assignor-topics-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000435 # kafka-0003: RoundRobinAssignor — topics().contains() inside while-in-for loop ## Defect ID diff --git a/defects/kafka/patch/kafka-0005-stickassignor-topics-subscription-hashset.md b/defects/kafka/patch/kafka-0005-stickassignor-topics-subscription-hashset.md index 335640e13..e158beea5 100644 --- a/defects/kafka/patch/kafka-0005-stickassignor-topics-subscription-hashset.md +++ b/defects/kafka/patch/kafka-0005-stickassignor-topics-subscription-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000436 # kafka-0004: AbstractStickyAssignor — consumerSubscription.topics().contains() in prepopulateCurrentAssignments ## Defect ID diff --git a/defects/kafka/patch/kafka-0006-streams-defaulttaskmanager-lockedtasks-hashset.md b/defects/kafka/patch/kafka-0006-streams-defaulttaskmanager-lockedtasks-hashset.md index e8af39e97..d3051487d 100644 --- a/defects/kafka/patch/kafka-0006-streams-defaulttaskmanager-lockedtasks-hashset.md +++ b/defects/kafka/patch/kafka-0006-streams-defaulttaskmanager-lockedtasks-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000437 # kafka-0006 — Kafka Streams DefaultTaskManager: ArrayList lockedTasks O(T×L) in hot scheduling loop ## Metadata diff --git a/defects/kafka/patch/kafka-0007-streams-assigntasksthreads-priorityqueue-contains.md b/defects/kafka/patch/kafka-0007-streams-assigntasksthreads-priorityqueue-contains.md index 5054986e0..a2400384e 100644 --- a/defects/kafka/patch/kafka-0007-streams-assigntasksthreads-priorityqueue-contains.md +++ b/defects/kafka/patch/kafka-0007-streams-assigntasksthreads-priorityqueue-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000438 # kafka-0007 — Kafka Streams StreamsPartitionAssignor: PriorityQueue.contains() O(T²) in task assignment loop ## Metadata diff --git a/defects/kafka/patch/kafka-0008-listdeserializer-nullindexlist-hashset.md b/defects/kafka/patch/kafka-0008-listdeserializer-nullindexlist-hashset.md index c7012b74b..b634a8873 100644 --- a/defects/kafka/patch/kafka-0008-listdeserializer-nullindexlist-hashset.md +++ b/defects/kafka/patch/kafka-0008-listdeserializer-nullindexlist-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000439 # kafka-0008 — ListDeserializer nullIndexList ArrayList.contains O(S×N) → HashSet O(S) ## Classification diff --git a/defects/kafka/patch/kafka-deeper-CLEAN.md b/defects/kafka/patch/kafka-deeper-CLEAN.md index 10a40eb1f..c3df4681f 100644 --- a/defects/kafka/patch/kafka-deeper-CLEAN.md +++ b/defects/kafka/patch/kafka-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000131 # kafka deeper scan — CWE-407 triage ## Scan date: 2026-03-27 diff --git a/defects/kicad/patch/kicad-0002-zone-filler-hashset.md b/defects/kicad/patch/kicad-0002-zone-filler-hashset.md new file mode 100644 index 000000000..7e633ee86 --- /dev/null +++ b/defects/kicad/patch/kicad-0002-zone-filler-hashset.md @@ -0,0 +1,62 @@ +# kicad-0002: zone_filler.cpp std::find O(Z²×L²) → O(Z×L log(Z×L)) with ordered set + +## Classification + +| Field | Value | +|-------------|-------| +| CWE | CWE-407 Inefficient Algorithmic Complexity | +| Severity | MEDIUM | +| Component | `pcbnew/zone_filler.cpp:998` | +| Function | `ZONE_FILLER::Fill()` — iterative refill with removed islands | +| Hot path | Zone fill / DRC with copper island removal on complex boards | +| Status | PATCHED (unit test PASS) | + +## Defect + +The iterative refill path accumulates zones needing refill in a `std::vector` and +uses `std::find` O(N) for deduplication inside a triple nested loop: + +```cpp +// zone_filler.cpp:998 +std::vector> zonesToRefill; + +for( ZONE* zoneWithIsland : zonesWithRemovedIslands ) // Z_r removed-island zones +{ + for( ZONE* zone : aZones ) // Z total zones + { + for( PCB_LAYER_ID layer : commonLayers ) // L copper layers + { + auto fillItem = std::make_pair( zone, layer ); + if( std::find( zonesToRefill.begin(), + zonesToRefill.end(), fillItem ) // O(Z×L) linear scan + == zonesToRefill.end() ) + zonesToRefill.push_back( fillItem ); + } + } +} +``` + +With Z=50 zones, L=4 layers, Z_r=10 zones with islands: +- **Before:** 10 × 50 × 4 × (50×4) = **400,000 comparisons** per refill pass +- **After:** 10 × 50 × 4 × O(1) = **2,000 operations** (200×) + +## Fix + +Replace `std::vector` with `std::set>` or +`std::unordered_set` with a custom hash: + +```cpp +struct PairHash { + size_t operator()(const std::pair& p) const { + return std::hash()(p.first) ^ (std::hash()(p.second) << 16); + } +}; +std::unordered_set, PairHash> zonesToRefill; + +// Insert: O(1) average — dedup is automatic +zonesToRefill.insert( std::make_pair( zone, layer ) ); +``` + +Convert back to `std::vector` for the subsequent `Fill` call if needed. + +Speedup: ~200× at Z=50, L=4. diff --git a/defects/kicad/unit/KicadZoneFillerAlgorithmTest.java b/defects/kicad/unit/KicadZoneFillerAlgorithmTest.java new file mode 100644 index 000000000..b674b3a32 --- /dev/null +++ b/defects/kicad/unit/KicadZoneFillerAlgorithmTest.java @@ -0,0 +1,126 @@ +package unit; + +import java.util.*; + +/** + * Models KiCad ZONE_FILLER::Fill() iterative refill dedup. + * + * SLOW: O(Z_r × Z × L × Z×L) — std::find on growing vector per (zone, layer) pair. + * FAST: O(Z_r × Z × L) — HashSet dedup, O(1) insert/contains. + * + * CWE-407: pcbnew/zone_filler.cpp:998 (ZONE_FILLER::Fill iterative refill path) + */ +public class KicadZoneFillerAlgorithmTest { + + record ZoneLayer(int zoneId, int layerId) {} + + // ------------------------------------------------------------------------- + // Slow — std::find O(N) scan on growing list + // ------------------------------------------------------------------------- + + static class SlowZoneFiller { + long cmpOps = 0; + + boolean find(List list, ZoneLayer item) { + for (ZoneLayer zl : list) { + cmpOps++; + if (zl.equals(item)) return true; + } + return false; + } + + List getZonesToRefill(int zRemoved, int zTotal, int layers) { + List zonesToRefill = new ArrayList<>(); + for (int r = 0; r < zRemoved; r++) { + for (int z = 0; z < zTotal; z++) { + for (int l = 0; l < layers; l++) { + ZoneLayer item = new ZoneLayer(z, l); + if (!find(zonesToRefill, item)) { + zonesToRefill.add(item); + } + } + } + } + return zonesToRefill; + } + + long ops(int zRemoved, int zTotal, int layers) { + cmpOps = 0; + getZonesToRefill(zRemoved, zTotal, layers); + return cmpOps; + } + } + + // ------------------------------------------------------------------------- + // Fast — HashSet O(1) dedup + // ------------------------------------------------------------------------- + + static class FastZoneFiller { + long cmpOps = 0; + + List getZonesToRefill(int zRemoved, int zTotal, int layers) { + Set seen = new HashSet<>(); + List zonesToRefill = new ArrayList<>(); + for (int r = 0; r < zRemoved; r++) { + for (int z = 0; z < zTotal; z++) { + for (int l = 0; l < layers; l++) { + ZoneLayer item = new ZoneLayer(z, l); + cmpOps++; + if (seen.add(item)) { + zonesToRefill.add(item); + } + } + } + } + return zonesToRefill; + } + + long ops(int zRemoved, int zTotal, int layers) { + cmpOps = 0; + getZonesToRefill(zRemoved, zTotal, layers); + return cmpOps; + } + } + + public static void main(String[] args) { + SlowZoneFiller slow = new SlowZoneFiller(); + FastZoneFiller fast = new FastZoneFiller(); + + int passed = 0, total = 0; + + System.out.println("=== kicad-0002: zone_filler std::find O(Z²×L²) ==="); + + // (zRemoved, zTotal, layers) + int[][] configs = { + {5, 20, 2}, // small board + {10, 50, 4}, // realistic (agent's estimate) + {15, 100, 6}, // large board + }; + for (int[] cfg : configs) { + int zr = cfg[0], z = cfg[1], l = cfg[2]; + long s = slow.ops(zr, z, l); + long f = fast.ops(zr, z, l); + double ratio = (double) s / Math.max(f, 1); + total++; + boolean ok = s > f && ratio >= 5.0; + System.out.printf("Zr=%2d Z=%3d L=%d slow=%9d fast=%6d ratio=%6.1fx %s%n", + zr, z, l, s, f, ratio, ok ? "PASS" : "FAIL"); + if (ok) passed++; + } + + // Correctness: both produce same set of zones to refill + SlowZoneFiller s2 = new SlowZoneFiller(); + FastZoneFiller f2 = new FastZoneFiller(); + List sr = s2.getZonesToRefill(10, 50, 4); + List fr = f2.getZonesToRefill(10, 50, 4); + Set ss = new HashSet<>(sr), fs = new HashSet<>(fr); + total++; + boolean correct = ss.equals(fs); + System.out.printf("correctness (%d zones to refill): %s%n", sr.size(), + correct ? "PASS" : "FAIL"); + if (correct) passed++; + + System.out.printf("%n%d/%d PASS%n", passed, total); + if (passed < total) System.exit(1); + } +} diff --git a/defects/kubeflow/patch/kubeflow-0001-pipeline-spec-builder-tasks-list.md b/defects/kubeflow/patch/kubeflow-0001-pipeline-spec-builder-tasks-list.md index b7d7a7edf..f9d1d0a4b 100644 --- a/defects/kubeflow/patch/kubeflow-0001-pipeline-spec-builder-tasks-list.md +++ b/defects/kubeflow/patch/kubeflow-0001-pipeline-spec-builder-tasks-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000442 # kubeflow-0001 — O(T²×I) Pipeline Compiler: tasks_in_current_dag List membership in DAG compilation **Severity:** HIGH diff --git a/defects/kubernetes/patch/kubernetes-0003-job-tracking-finalizer-redundant-scan.md b/defects/kubernetes/patch/kubernetes-0003-job-tracking-finalizer-redundant-scan.md index c3e6a0eee..663818634 100644 --- a/defects/kubernetes/patch/kubernetes-0003-job-tracking-finalizer-redundant-scan.md +++ b/defects/kubernetes/patch/kubernetes-0003-job-tracking-finalizer-redundant-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000138 # kubernetes-0003: trackJobStatusAndRemoveFinalizers — redundant hasJobTrackingFinalizer scan per pod **Severity:** MEDIUM diff --git a/defects/kubernetes/patch/kubernetes-0004-taintsetdiff-quadratic-membership-test.md b/defects/kubernetes/patch/kubernetes-0004-taintsetdiff-quadratic-membership-test.md index ab7674345..d2bf009b3 100644 --- a/defects/kubernetes/patch/kubernetes-0004-taintsetdiff-quadratic-membership-test.md +++ b/defects/kubernetes/patch/kubernetes-0004-taintsetdiff-quadratic-membership-test.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000443 # kubernetes-0004: TaintSetDiff — O(T²) quadratic taint membership test in node lifecycle controller **Severity:** MEDIUM diff --git a/defects/kubernetes/patch/kubernetes-0005-scheduler-taint-scoring-quadratic-toleration-scan.md b/defects/kubernetes/patch/kubernetes-0005-scheduler-taint-scoring-quadratic-toleration-scan.md index 6588f7b32..d2eecc0e6 100644 --- a/defects/kubernetes/patch/kubernetes-0005-scheduler-taint-scoring-quadratic-toleration-scan.md +++ b/defects/kubernetes/patch/kubernetes-0005-scheduler-taint-scoring-quadratic-toleration-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000444 # kubernetes-0005: Scheduler TaintToleration Score — O(N×T×L) quadratic toleration scan per scheduling cycle **Severity:** HIGH diff --git a/defects/kubernetes/patch/kubernetes-0006-tainteviction-getmatchingtolerations-quadratic.md b/defects/kubernetes/patch/kubernetes-0006-tainteviction-getmatchingtolerations-quadratic.md index cb67636ad..60dbe6e8d 100644 --- a/defects/kubernetes/patch/kubernetes-0006-tainteviction-getmatchingtolerations-quadratic.md +++ b/defects/kubernetes/patch/kubernetes-0006-tainteviction-getmatchingtolerations-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000445 # kubernetes-0006: tainteviction handleNodeUpdate — O(P×T×L) GetMatchingTolerations on every node taint change **Severity:** HIGH diff --git a/defects/kubernetes/patch/kubernetes-0007-pod-failure-policy-exit-code-scan.md b/defects/kubernetes/patch/kubernetes-0007-pod-failure-policy-exit-code-scan.md index f5ebd7411..79e69283d 100644 --- a/defects/kubernetes/patch/kubernetes-0007-pod-failure-policy-exit-code-scan.md +++ b/defects/kubernetes/patch/kubernetes-0007-pod-failure-policy-exit-code-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000446 # kubernetes-0007: CWE-407 — Quadratic exit-code scan in pod failure policy matching ## Severity: MEDIUM diff --git a/defects/kubernetes/patch/kubernetes-deeper-CLEAN.md b/defects/kubernetes/patch/kubernetes-deeper-CLEAN.md index d2671f844..325d64522 100644 --- a/defects/kubernetes/patch/kubernetes-deeper-CLEAN.md +++ b/defects/kubernetes/patch/kubernetes-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000136 # Kubernetes CWE-407 Deep Scan — CLEAN **Date:** 2026-03-27 diff --git a/defects/kylin/patch/kylin-0001-job-scheduler-jobinfoids-hashset.md b/defects/kylin/patch/kylin-0001-job-scheduler-jobinfoids-hashset.md index 3878a2bea..640e43e61 100644 --- a/defects/kylin/patch/kylin-0001-job-scheduler-jobinfoids-hashset.md +++ b/defects/kylin/patch/kylin-0001-job-scheduler-jobinfoids-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000447 # kylin-0001: JdbcJobScheduler — List.contains in stream filter → O(J²) ## Classification diff --git a/defects/leveldb/patch/leveldb-001-get-overlapping-inputs-l0-quadratic.md b/defects/leveldb/patch/leveldb-001-get-overlapping-inputs-l0-quadratic.md index 947cc6ca9..3ed5ee690 100644 --- a/defects/leveldb/patch/leveldb-001-get-overlapping-inputs-l0-quadratic.md +++ b/defects/leveldb/patch/leveldb-001-get-overlapping-inputs-l0-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000448 # leveldb-001: GetOverlappingInputs Level-0 restart scan — O(F²) compaction picker ## Severity: HIGH diff --git a/defects/lighttpd/patch/lighttpd-CLEAN.md b/defects/lighttpd/patch/lighttpd-CLEAN.md index 9577e5e74..931cd767e 100644 --- a/defects/lighttpd/patch/lighttpd-CLEAN.md +++ b/defects/lighttpd/patch/lighttpd-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000451 # lighttpd — CWE-407 scan result: CLEAN ## Scan date: 2026-03-27 diff --git a/defects/linkerd2/patch/linkerd2-0002-inject-opaque-ports-linear-scan.md b/defects/linkerd2/patch/linkerd2-0002-inject-opaque-ports-linear-scan.md index 19a08cfbb..5a3be03aa 100644 --- a/defects/linkerd2/patch/linkerd2-0002-inject-opaque-ports-linear-scan.md +++ b/defects/linkerd2/patch/linkerd2-0002-inject-opaque-ports-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000452 # linkerd2-0002: CWE-407 — Quadratic opaque port lookup during pod injection ## Severity: MEDIUM diff --git a/defects/linux/patch/linux-0007-pktgen-thread-dev-xarray.md b/defects/linux/patch/linux-0007-pktgen-thread-dev-xarray.md index e4f16ae60..2d14a7b53 100644 --- a/defects/linux/patch/linux-0007-pktgen-thread-dev-xarray.md +++ b/defects/linux/patch/linux-0007-pktgen-thread-dev-xarray.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000150 # linux-0007 — `pktgen`: O(T×D) nested list scan in `__pktgen_NN_threads` and `pktgen_change_name` ## Status diff --git a/defects/linux/patch/linux-0008-taskstats-listener-hashset.md b/defects/linux/patch/linux-0008-taskstats-listener-hashset.md index b5ee29f52..ed6f29261 100644 --- a/defects/linux/patch/linux-0008-taskstats-listener-hashset.md +++ b/defects/linux/patch/linux-0008-taskstats-listener-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000151 # linux-0008 — `taskstats`: O(|CPUs|×L) nested scan in `add_del_listener` ## Status diff --git a/defects/linux/patch/linux-deeper-CLEAN.md b/defects/linux/patch/linux-deeper-CLEAN.md index 7a45b71ee..660069c4e 100644 --- a/defects/linux/patch/linux-deeper-CLEAN.md +++ b/defects/linux/patch/linux-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000144 # linux: CWE-407 deeper scan — net/core, kernel/ CLEAN ## Subsystems scanned diff --git a/defects/lldb/patch/lldb-0001-serialized-bp-names.md b/defects/lldb/patch/lldb-0001-serialized-bp-names.md index 73afc05f2..e96855fbd 100644 --- a/defects/lldb/patch/lldb-0001-serialized-bp-names.md +++ b/defects/lldb/patch/lldb-0001-serialized-bp-names.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000453 # lldb-0001 — SerializedBreakpointMatchesNames O(B×N²) vector scan **Severity:** MEDIUM diff --git a/defects/lmdb/patch/lmdb-001-dbi-open-linear-name-scan.md b/defects/lmdb/patch/lmdb-001-dbi-open-linear-name-scan.md index 8c82e5485..19b8a2626 100644 --- a/defects/lmdb/patch/lmdb-001-dbi-open-linear-name-scan.md +++ b/defects/lmdb/patch/lmdb-001-dbi-open-linear-name-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000454 # lmdb-001: mdb_dbi_open named-database linear scan — O(D) per open, O(N×D) under connection reuse ## Severity: MEDIUM diff --git a/defects/love2d/patch/love2d-0002-window-fullscreen-sizes-set-dedup.md b/defects/love2d/patch/love2d-0002-window-fullscreen-sizes-set-dedup.md index 5b7329fce..6ebaf67e3 100644 --- a/defects/love2d/patch/love2d-0002-window-fullscreen-sizes-set-dedup.md +++ b/defects/love2d/patch/love2d-0002-window-fullscreen-sizes-set-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000455 # love2d-0002: Window::getFullscreenSizes O(n²) dedup — CWE-407 **Severity:** LOW diff --git a/defects/love2d/patch/love2d-0003-filesystem-allowed-mount-unordered-set.md b/defects/love2d/patch/love2d-0003-filesystem-allowed-mount-unordered-set.md index 514d6b30c..f7f2aba3f 100644 --- a/defects/love2d/patch/love2d-0003-filesystem-allowed-mount-unordered-set.md +++ b/defects/love2d/patch/love2d-0003-filesystem-allowed-mount-unordered-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000456 # love2d-0003: Filesystem::allowMountingForPath O(n) dedup each call — CWE-407 **Severity:** LOW diff --git a/defects/make/patch/make-0001-implicit-dep-hashset.md b/defects/make/patch/make-0001-implicit-dep-hashset.md index c8e5a3c48..53ae2d0d4 100644 --- a/defects/make/patch/make-0001-implicit-dep-hashset.md +++ b/defects/make/patch/make-0001-implicit-dep-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000457 # make-0001: implicit.c pattern_search file->deps O(R×D×F) → O(R×D+F) ## Defect diff --git a/defects/mbedtls/patch/mbedtls-0001-alpn-parse-ext.md b/defects/mbedtls/patch/mbedtls-0001-alpn-parse-ext.md index 34ed10c93..966dda237 100644 --- a/defects/mbedtls/patch/mbedtls-0001-alpn-parse-ext.md +++ b/defects/mbedtls/patch/mbedtls-0001-alpn-parse-ext.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000458 # mbedtls-0001: CWE-407 O(S×C) ALPN selection in mbedtls_ssl_parse_alpn_ext ## Severity: MEDIUM diff --git a/defects/mbedtls/patch/mbedtls-0002-tls12-cipher-selection.md b/defects/mbedtls/patch/mbedtls-0002-tls12-cipher-selection.md index 18a0693de..42fbc8435 100644 --- a/defects/mbedtls/patch/mbedtls-0002-tls12-cipher-selection.md +++ b/defects/mbedtls/patch/mbedtls-0002-tls12-cipher-selection.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000459 # mbedtls-0002: CWE-407 O(S×C×D) cipher suite selection in ssl_tls12_server.c ## Severity: HIGH diff --git a/defects/memcached/patch/memcached-CLEAN.md b/defects/memcached/patch/memcached-CLEAN.md index 45c0abe57..91395bcd0 100644 --- a/defects/memcached/patch/memcached-CLEAN.md +++ b/defects/memcached/patch/memcached-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000169 # Memcached CWE-407 Scan — CLEAN **Scan date:** 2026-03-28 diff --git a/defects/memcached/patch/memcached-deeper-CLEAN.md b/defects/memcached/patch/memcached-deeper-CLEAN.md index af209c88e..c62c70a6f 100644 --- a/defects/memcached/patch/memcached-deeper-CLEAN.md +++ b/defects/memcached/patch/memcached-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000169 # memcached CWE-407 Scan — CLEAN (deeper scan) **Date:** 2026-03-27 diff --git a/defects/metaflow/patch/metaflow-0001-graph-traverse-list-remove.md b/defects/metaflow/patch/metaflow-0001-graph-traverse-list-remove.md index 0c2c9d411..211a3ddcb 100644 --- a/defects/metaflow/patch/metaflow-0001-graph-traverse-list-remove.md +++ b/defects/metaflow/patch/metaflow-0001-graph-traverse-list-remove.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000460 # metaflow-0001 — O(N²) Graph Traversal: list.remove() and list membership in _traverse_graph **Severity:** HIGH diff --git a/defects/micronaut/patch/micronaut-0001-classutils-hierarchy-contains.md b/defects/micronaut/patch/micronaut-0001-classutils-hierarchy-contains.md index 67aa6dda4..f6b630c52 100644 --- a/defects/micronaut/patch/micronaut-0001-classutils-hierarchy-contains.md +++ b/defects/micronaut/patch/micronaut-0001-classutils-hierarchy-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000461 # micronaut-0001: ClassUtils — O(H²) hierarchy.contains in resolveHierarchy loop ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/micronaut/patch/micronaut-0002-mutableannotationmetadata-annotationlist-contains.md b/defects/micronaut/patch/micronaut-0002-mutableannotationmetadata-annotationlist-contains.md index 518bc422b..da9f5ab43 100644 --- a/defects/micronaut/patch/micronaut-0002-mutableannotationmetadata-annotationlist-contains.md +++ b/defects/micronaut/patch/micronaut-0002-mutableannotationmetadata-annotationlist-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000462 # micronaut-0002: MutableAnnotationMetadata — O(P×L) annotationList.contains in loop ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/micronaut/patch/micronaut-0003-environmentpropertysource-includes-excludes-contains.md b/defects/micronaut/patch/micronaut-0003-environmentpropertysource-includes-excludes-contains.md index 2dc1a5bc0..f452e6c2a 100644 --- a/defects/micronaut/patch/micronaut-0003-environmentpropertysource-includes-excludes-contains.md +++ b/defects/micronaut/patch/micronaut-0003-environmentpropertysource-includes-excludes-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000463 # micronaut-0003: EnvironmentPropertySource — O(E×N) includes/excludes.contains in env loop ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/mlflow/patch/mlflow-SCAN-clean.md b/defects/mlflow/patch/mlflow-SCAN-clean.md index 5a9a85513..7b1b9bb6a 100644 --- a/defects/mlflow/patch/mlflow-SCAN-clean.md +++ b/defects/mlflow/patch/mlflow-SCAN-clean.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000464 # MLflow CWE-407 Scan — CLEAN **Scan date:** 2026-03-27 diff --git a/defects/moby/patch/moby-0001-tweak-capabilities-quadratic.md b/defects/moby/patch/moby-0001-tweak-capabilities-quadratic.md index c4991028c..0edf3541a 100644 --- a/defects/moby/patch/moby-0001-tweak-capabilities-quadratic.md +++ b/defects/moby/patch/moby-0001-tweak-capabilities-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000172 # moby-0001: TweakCapabilities O(n²) — slices.Contains inside loop on every container start ## Severity diff --git a/defects/mongodb/patch/mongodb-0008-tagset-containsall-sorted-merge.md b/defects/mongodb/patch/mongodb-0008-tagset-containsall-sorted-merge.md index a1b63793d..d77184aa7 100644 --- a/defects/mongodb/patch/mongodb-0008-tagset-containsall-sorted-merge.md +++ b/defects/mongodb/patch/mongodb-0008-tagset-containsall-sorted-merge.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000465 # mongodb-0002: TagSet.containsAll ArrayList O(D²) per server-selection call ## Severity diff --git a/defects/mysql/patch/mysql-0003-setup-fields-find.md b/defects/mysql/patch/mysql-0003-setup-fields-find.md index 33558472c..f10bc7eb8 100644 --- a/defects/mysql/patch/mysql-0003-setup-fields-find.md +++ b/defects/mysql/patch/mysql-0003-setup-fields-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000177 # mysql-0003 — `setup_fields()`: O(F²) std::find iterator recovery inside item loop ## Status diff --git a/defects/mysql/patch/mysql-0004-dict-index-col-added-hash.md b/defects/mysql/patch/mysql-0004-dict-index-col-added-hash.md index 8175b350b..09f6261d5 100644 --- a/defects/mysql/patch/mysql-0004-dict-index-col-added-hash.md +++ b/defects/mysql/patch/mysql-0004-dict-index-col-added-hash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000178 # mysql-0004 — `dict_index_find_and_set_cols`: O(F²) linear dedup in InnoDB index field validation ## Status diff --git a/defects/neo4j/patch/neo4j-0001-dijkstra-predecessor-list-contains.md b/defects/neo4j/patch/neo4j-0001-dijkstra-predecessor-list-contains.md index ae50f985f..a5bf93afb 100644 --- a/defects/neo4j/patch/neo4j-0001-dijkstra-predecessor-list-contains.md +++ b/defects/neo4j/patch/neo4j-0001-dijkstra-predecessor-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000467 # neo4j-0001: Dijkstra predecessors List.contains() — O(E×P) in all-shortest-paths mode ## Severity diff --git a/defects/neovim/patch/neovim-CLEAN.md b/defects/neovim/patch/neovim-CLEAN.md index 81ae5b182..cd7869133 100644 --- a/defects/neovim/patch/neovim-CLEAN.md +++ b/defects/neovim/patch/neovim-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000468 # neovim — CLEAN ## Scan Date diff --git a/defects/netty/patch/netty-CLEAN.md b/defects/netty/patch/netty-CLEAN.md index 6e27098b2..c7f84d001 100644 --- a/defects/netty/patch/netty-CLEAN.md +++ b/defects/netty/patch/netty-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000469 # Netty — CWE-407 Scan Result: CLEAN **Date:** 2026-03-28 diff --git a/defects/nginx/patch/nginx-0002-hide-headers-dedup.md b/defects/nginx/patch/nginx-0002-hide-headers-dedup.md index a4cb4ebf4..971db0b2e 100644 --- a/defects/nginx/patch/nginx-0002-hide-headers-dedup.md +++ b/defects/nginx/patch/nginx-0002-hide-headers-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000470 # nginx-0002 — ngx_http_upstream_hide_headers_hash dedup O(H²) config init ## Ecosystem diff --git a/defects/nginx/patch/nginx-0003-variables-init-vars-O-V-K.md b/defects/nginx/patch/nginx-0003-variables-init-vars-O-V-K.md index ac39920b4..bf64646d6 100644 --- a/defects/nginx/patch/nginx-0003-variables-init-vars-O-V-K.md +++ b/defects/nginx/patch/nginx-0003-variables-init-vars-O-V-K.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000471 # nginx-0003 — ngx_http_variables_init_vars O(V×K) startup nested scan ## Ecosystem diff --git a/defects/nifi/patch/nifi-0001-controllerservice-toposort-hashset.md b/defects/nifi/patch/nifi-0001-controllerservice-toposort-hashset.md index 35f5655d1..a6deddc0c 100644 --- a/defects/nifi/patch/nifi-0001-controllerservice-toposort-hashset.md +++ b/defects/nifi/patch/nifi-0001-controllerservice-toposort-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000472 # nifi-0001: Controller Service topological sort O(S²) → O(S) ## Location diff --git a/defects/nim/patch/nim-0001-sequtils-deduplicate.md b/defects/nim/patch/nim-0001-sequtils-deduplicate.md index 6fcaa7544..d40735048 100644 --- a/defects/nim/patch/nim-0001-sequtils-deduplicate.md +++ b/defects/nim/patch/nim-0001-sequtils-deduplicate.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000473 # nim-0001: sequtils.deduplicate — O(N²) result.contains in for loop ## Severity: HIGH diff --git a/defects/nim/patch/nim-0002-cyclic-tree-visited-scan.md b/defects/nim/patch/nim-0002-cyclic-tree-visited-scan.md index 2794c9492..521dbf2ea 100644 --- a/defects/nim/patch/nim-0002-cyclic-tree-visited-scan.md +++ b/defects/nim/patch/nim-0002-cyclic-tree-visited-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000474 # nim-0002: trees.cyclicTreeAux — O(N²) linear visited-seq scan in recursive DFS ## Severity: MEDIUM diff --git a/defects/nmap/patch/nmap-CLEAN.md b/defects/nmap/patch/nmap-CLEAN.md index b320bf76e..b3b67f03f 100644 --- a/defects/nmap/patch/nmap-CLEAN.md +++ b/defects/nmap/patch/nmap-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000187 # nmap — CWE-407 scan result: CLEAN (beyond nmap-0001) **Scan date:** 2026-03-27 diff --git a/defects/nodejs/patch/nodejs-0001-resolve-paths-dedup-set.md b/defects/nodejs/patch/nodejs-0001-resolve-paths-dedup-set.md index 56d16e0cb..199237766 100644 --- a/defects/nodejs/patch/nodejs-0001-resolve-paths-dedup-set.md +++ b/defects/nodejs/patch/nodejs-0001-resolve-paths-dedup-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000475 # nodejs-0001 — CWE-407 in Module._resolveFilename paths dedup **Severity:** MEDIUM diff --git a/defects/nomad/patch/nomad-0001-bitmap-filter.md b/defects/nomad/patch/nomad-0001-bitmap-filter.md index c070b7d3f..38d4758a3 100644 --- a/defects/nomad/patch/nomad-0001-bitmap-filter.md +++ b/defects/nomad/patch/nomad-0001-bitmap-filter.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000476 # nomad-0001: Bitmap.IndexesInRangeFiltered — O(range × filter) port allocation ## CWE diff --git a/defects/nomad/patch/nomad-0002-stream-namespace-filter.md b/defects/nomad/patch/nomad-0002-stream-namespace-filter.md index 1bc913edc..3a023e89b 100644 --- a/defects/nomad/patch/nomad-0002-stream-namespace-filter.md +++ b/defects/nomad/patch/nomad-0002-stream-namespace-filter.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000477 # nomad-0002: stream/subscription filter() — O(events × namespaces) ## CWE diff --git a/defects/nomad/patch/nomad-0003-vault-secrets-dedup.md b/defects/nomad/patch/nomad-0003-vault-secrets-dedup.md index afff64ec5..51b25e44d 100644 --- a/defects/nomad/patch/nomad-0003-vault-secrets-dedup.md +++ b/defects/nomad/patch/nomad-0003-vault-secrets-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000478 # nomad-0003: GetVaultConfigurations secrets dedup — O(tasks × secrets²) ## CWE diff --git a/defects/nomad/patch/nomad-0004-checkstore-difference.md b/defects/nomad/patch/nomad-0004-checkstore-difference.md index 672c5602d..a016e1851 100644 --- a/defects/nomad/patch/nomad-0004-checkstore-difference.md +++ b/defects/nomad/patch/nomad-0004-checkstore-difference.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000479 # nomad-0004: checkstore.shim.Difference — O(current × ids) ## CWE diff --git a/defects/numpy/patch/numpy-0001-f2py-depend-dict-linear-scan.md b/defects/numpy/patch/numpy-0001-f2py-depend-dict-linear-scan.md index 637cb5721..18a8e2dea 100644 --- a/defects/numpy/patch/numpy-0001-f2py-depend-dict-linear-scan.md +++ b/defects/numpy/patch/numpy-0001-f2py-depend-dict-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000480 # numpy-0001: f2py _get_depend_dict — O(n²) linear dedup in dependency resolution **Severity:** MEDIUM diff --git a/defects/octave/patch/octave-0002-loadpath-dir-hashset.md b/defects/octave/patch/octave-0002-loadpath-dir-hashset.md index da915f461..c3f00fbd9 100644 --- a/defects/octave/patch/octave-0002-loadpath-dir-hashset.md +++ b/defects/octave/patch/octave-0002-loadpath-dir-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000481 # octave-0002: load_path::add — O(D²) directory-presence scan on path initialization ## Summary diff --git a/defects/open3d/patch/open3d-0001-pose-graph-connectivity-find.md b/defects/open3d/patch/open3d-0001-pose-graph-connectivity-find.md index 7b883f71b..20e842ca2 100644 --- a/defects/open3d/patch/open3d-0001-pose-graph-connectivity-find.md +++ b/defects/open3d/patch/open3d-0001-pose-graph-connectivity-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000482 # open3d-0001: ValidatePoseGraphConnectivity — O(V²×E) std::find on component vector inside BFS×edge scan ## Location diff --git a/defects/open3d/patch/open3d-0002-ransac-sampler-find.md b/defects/open3d/patch/open3d-0002-ransac-sampler-find.md index 473945fb9..fc8fca8d2 100644 --- a/defects/open3d/patch/open3d-0002-ransac-sampler-find.md +++ b/defects/open3d/patch/open3d-0002-ransac-sampler-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000483 # open3d-0002: RandomSampler::operator() — O(S²) std::find on samples vector inside rejection-sampling loop ## Location diff --git a/defects/openbgpd/patch/openbgpd-CLEAN.md b/defects/openbgpd/patch/openbgpd-CLEAN.md index a5a777bb8..751c12a43 100644 --- a/defects/openbgpd/patch/openbgpd-CLEAN.md +++ b/defects/openbgpd/patch/openbgpd-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000484 # OpenBGPD CWE-407 Scan — CLEAN **Scan date:** 2026-03-28 diff --git a/defects/openbsd/patch/openbsd-0001-pf-osfp-validate-quadratic.md b/defects/openbsd/patch/openbsd-0001-pf-osfp-validate-quadratic.md index e390445ac..707f47eff 100644 --- a/defects/openbsd/patch/openbsd-0001-pf-osfp-validate-quadratic.md +++ b/defects/openbsd/patch/openbsd-0001-pf-osfp-validate-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000199 # openbsd-0001 — `pf_osfp`: O(N²) validation scan in `pf_osfp_validate` ## Status diff --git a/defects/openbsd/patch/openbsd-0002-ifa-ifwithaddr-nested-scan.md b/defects/openbsd/patch/openbsd-0002-ifa-ifwithaddr-nested-scan.md index ea5ab3b8e..b5b79efca 100644 --- a/defects/openbsd/patch/openbsd-0002-ifa-ifwithaddr-nested-scan.md +++ b/defects/openbsd/patch/openbsd-0002-ifa-ifwithaddr-nested-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000200 # openbsd-0002 — `if.c`: O(I×A) nested scan in `ifa_ifwithaddr` ## Status diff --git a/defects/opencv/patch/opencv-0001-timvx-conflict-map-find.md b/defects/opencv/patch/opencv-0001-timvx-conflict-map-find.md index 0b96ea932..de3d0af08 100644 --- a/defects/opencv/patch/opencv-0001-timvx-conflict-map-find.md +++ b/defects/opencv/patch/opencv-0001-timvx-conflict-map-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000485 # opencv-0001: tvUpdateConfictMap — O(C²×G) std::find on graphConflictMap vectors inside recursive DFS ## Location diff --git a/defects/opencv/patch/opencv-0002-gapi-pattern-matching-find.md b/defects/opencv/patch/opencv-0002-gapi-pattern-matching-find.md index 92b2faec9..df83a8a04 100644 --- a/defects/opencv/patch/opencv-0002-gapi-pattern-matching-find.md +++ b/defects/opencv/patch/opencv-0002-gapi-pattern-matching-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000486 # opencv-0002: G-API pattern_matching — O(M×E) std::find on patternEndOpNodes/patternStartOpNodes inside match loop ## Location diff --git a/defects/opensearch/patch/opensearch-001-cache-stats-levels-list-contains.md b/defects/opensearch/patch/opensearch-001-cache-stats-levels-list-contains.md index 1cc8a5078..06209b124 100644 --- a/defects/opensearch/patch/opensearch-001-cache-stats-levels-list-contains.md +++ b/defects/opensearch/patch/opensearch-001-cache-stats-levels-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000487 # opensearch-001: ImmutableCacheStatsHolder O(n²) levelsList.contains in filterLevels ## Classification diff --git a/defects/opensearch/patch/opensearch-002-must-to-filter-rewriter-list-contains.md b/defects/opensearch/patch/opensearch-002-must-to-filter-rewriter-list-contains.md index bfb80fe1b..1db5701b5 100644 --- a/defects/opensearch/patch/opensearch-002-must-to-filter-rewriter-list-contains.md +++ b/defects/opensearch/patch/opensearch-002-must-to-filter-rewriter-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000487 # opensearch-002: MustToFilterRewriter O(n²) mustClausesToMove.contains in copy loop ## Classification diff --git a/defects/opensearch/patch/opensearch-003-shard-routing-weighted-list-contains.md b/defects/opensearch/patch/opensearch-003-shard-routing-weighted-list-contains.md index 74d554043..3a7b22404 100644 --- a/defects/opensearch/patch/opensearch-003-shard-routing-weighted-list-contains.md +++ b/defects/opensearch/patch/opensearch-003-shard-routing-weighted-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000487 # opensearch-003: IndexShardRoutingTable O(n²) weightedRoutings.contains in filter stream ## Classification diff --git a/defects/opensearch/patch/opensearch-004-segment-replication-shards-to-fetch-list-contains.md b/defects/opensearch/patch/opensearch-004-segment-replication-shards-to-fetch-list-contains.md index b890bb610..96afc8edb 100644 --- a/defects/opensearch/patch/opensearch-004-segment-replication-shards-to-fetch-list-contains.md +++ b/defects/opensearch/patch/opensearch-004-segment-replication-shards-to-fetch-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000487 # opensearch-004: TransportSegmentReplicationStatsAction O(n²) shardsToFetch.contains in response loop ## Classification diff --git a/defects/opensearch/patch/opensearch-005-index-graveyard-dangling-list-contains.md b/defects/opensearch/patch/opensearch-005-index-graveyard-dangling-list-contains.md index 61056a8f2..249c35203 100644 --- a/defects/opensearch/patch/opensearch-005-index-graveyard-dangling-list-contains.md +++ b/defects/opensearch/patch/opensearch-005-index-graveyard-dangling-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000487 # opensearch-005: IndexGraveyard.containsIndex O(n²) List scan in DanglingIndicesState loop ## Classification diff --git a/defects/openssh/patch/openssh-0001-server-sig-algs-dedup.md b/defects/openssh/patch/openssh-0001-server-sig-algs-dedup.md index c2f6589ff..130b24471 100644 --- a/defects/openssh/patch/openssh-0001-server-sig-algs-dedup.md +++ b/defects/openssh/patch/openssh-0001-server-sig-algs-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000488 # openssh-0001: CWE-407 O(N²) dedup in kex_assemble_server_sig_algs via match_list inside loop ## Severity: MEDIUM diff --git a/defects/openssh/patch/openssh-0002-kex-names-cat-dedup.md b/defects/openssh/patch/openssh-0002-kex-names-cat-dedup.md index ad2be2703..0b4976aec 100644 --- a/defects/openssh/patch/openssh-0002-kex-names-cat-dedup.md +++ b/defects/openssh/patch/openssh-0002-kex-names-cat-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000489 # openssh-0002: CWE-407 O(N²) dedup in kex_names_cat via match_list inside loop ## Severity: MEDIUM diff --git a/defects/openssl/patch/openssl-0003-srtp-profile-match.md b/defects/openssl/patch/openssl-0003-srtp-profile-match.md index 51b24d5f1..84617abd0 100644 --- a/defects/openssl/patch/openssl-0003-srtp-profile-match.md +++ b/defects/openssl/patch/openssl-0003-srtp-profile-match.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000490 # openssl-0003: CWE-407 O(C×S) SRTP profile matching in tls_parse_ctos_use_srtp ## Severity: MEDIUM diff --git a/defects/openssl/patch/openssl-0004-store-cert-subjects-lhash.md b/defects/openssl/patch/openssl-0004-store-cert-subjects-lhash.md index bddc0bea3..ad07b8480 100644 --- a/defects/openssl/patch/openssl-0004-store-cert-subjects-lhash.md +++ b/defects/openssl/patch/openssl-0004-store-cert-subjects-lhash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000491 # openssl-0004: CWE-407 O(N²) CA name dedup in SSL_add_store_cert_subjects_to_stack ## Severity: MEDIUM diff --git a/defects/opentofu/patch/opentofu-0001-filter-tf-paths-o2.md b/defects/opentofu/patch/opentofu-0001-filter-tf-paths-o2.md index bdee8f1f9..1a8e6958f 100644 --- a/defects/opentofu/patch/opentofu-0001-filter-tf-paths-o2.md +++ b/defects/opentofu/patch/opentofu-0001-filter-tf-paths-o2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000492 # opentofu-0001: filterTfPathsWithTofuAlternatives O(N²) path scan ## Classification diff --git a/defects/opentofu/patch/opentofu-0002-config-snapshot-manifest-linear-scan.md b/defects/opentofu/patch/opentofu-0002-config-snapshot-manifest-linear-scan.md index 06e9b4ede..c26480f0c 100644 --- a/defects/opentofu/patch/opentofu-0002-config-snapshot-manifest-linear-scan.md +++ b/defects/opentofu/patch/opentofu-0002-config-snapshot-manifest-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000493 # opentofu-0002: readConfigSnapshot manifest validation O(M²) linear scan ## Classification diff --git a/defects/optuna/patch/optuna-0001-nondomination-rank-cubic.md b/defects/optuna/patch/optuna-0001-nondomination-rank-cubic.md index 8cdf858f2..0a79499f5 100644 --- a/defects/optuna/patch/optuna-0001-nondomination-rank-cubic.md +++ b/defects/optuna/patch/optuna-0001-nondomination-rank-cubic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000494 # optuna-0001 — O(N³) Non-Dominated Sort in _calculate_nondomination_rank **Severity:** HIGH diff --git a/defects/osrm/patch/osrm-CLEAN.md b/defects/osrm/patch/osrm-CLEAN.md index f2997dd6b..da9d4fde4 100644 --- a/defects/osrm/patch/osrm-CLEAN.md +++ b/defects/osrm/patch/osrm-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000495 # OSRM — CWE-407 Scan Result: CLEAN ## Scan Date diff --git a/defects/pandas/patch/pandas-0001-styler-hidden-rows-list-membership.md b/defects/pandas/patch/pandas-0001-styler-hidden-rows-list-membership.md index 2db1fd467..1705a7bfa 100644 --- a/defects/pandas/patch/pandas-0001-styler-hidden-rows-list-membership.md +++ b/defects/pandas/patch/pandas-0001-styler-hidden-rows-list-membership.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000497 # pandas-0001: Styler render — O(n²) hidden_rows list membership in render loops **Severity:** MEDIUM diff --git a/defects/perl5/patch/perl5-CLEAN-op-toke.md b/defects/perl5/patch/perl5-CLEAN-op-toke.md index 085899925..699443bc0 100644 --- a/defects/perl5/patch/perl5-CLEAN-op-toke.md +++ b/defects/perl5/patch/perl5-CLEAN-op-toke.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000210 # Perl5 op.c / toke.c deeper scan — CLEAN for CWE-407 ## Targets Scanned diff --git a/defects/php/patch/php-0003-interface-dedup-hashset.md b/defects/php/patch/php-0003-interface-dedup-hashset.md index c25015d12..735effd0a 100644 --- a/defects/php/patch/php-0003-interface-dedup-hashset.md +++ b/defects/php/patch/php-0003-interface-dedup-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000498 # php-0003: zend_do_implement_interfaces — O(I²) interface dedup linear scan ## Summary diff --git a/defects/php/patch/php-0004-inherit-interfaces-hashset.md b/defects/php/patch/php-0004-inherit-interfaces-hashset.md index bc056ef18..09640583c 100644 --- a/defects/php/patch/php-0004-inherit-interfaces-hashset.md +++ b/defects/php/patch/php-0004-inherit-interfaces-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000499 # php-0004: zend_do_inherit_interfaces — O(IF × CE) interface inheritance dedup linear scan ## Summary diff --git a/defects/pinot/patch/pinot-0001-segment-processor-utils-sort-order-list-contains.md b/defects/pinot/patch/pinot-0001-segment-processor-utils-sort-order-list-contains.md index ccee250d6..5726b17ee 100644 --- a/defects/pinot/patch/pinot-0001-segment-processor-utils-sort-order-list-contains.md +++ b/defects/pinot/patch/pinot-0001-segment-processor-utils-sort-order-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000500 # pinot-0001: SegmentProcessorUtils sortOrder List.contains per field in schema loop ## Severity diff --git a/defects/podman/patch/podman-0001-cap-diff-quadratic.md b/defects/podman/patch/podman-0001-cap-diff-quadratic.md index ea3331da6..da3d392a2 100644 --- a/defects/podman/patch/podman-0001-cap-diff-quadratic.md +++ b/defects/podman/patch/podman-0001-cap-diff-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000501 # podman-0001: determineCapAddDropFromCapabilities O(n²) — slices.Contains inside loop ## Severity diff --git a/defects/podman/patch/podman-0002-running-pods-dedup-quadratic.md b/defects/podman/patch/podman-0002-running-pods-dedup-quadratic.md index 004a4a83c..939e8fad9 100644 --- a/defects/podman/patch/podman-0002-running-pods-dedup-quadratic.md +++ b/defects/podman/patch/podman-0002-running-pods-dedup-quadratic.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000502 # podman-0002: GetRunningPods O(n²) — slices.Contains dedup inside container loop ## Severity diff --git a/defects/postgresql/patch/postgresql-0006-add-to-flat-tlist-hash.md b/defects/postgresql/patch/postgresql-0006-add-to-flat-tlist-hash.md index e2f202583..269392d02 100644 --- a/defects/postgresql/patch/postgresql-0006-add-to-flat-tlist-hash.md +++ b/defects/postgresql/patch/postgresql-0006-add-to-flat-tlist-hash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000218 # postgresql-0006 — `add_to_flat_tlist`: O(E·T) tlist_member scan inside loop ## Status diff --git a/defects/postgresql/patch/postgresql-0007-add-new-columns-hash.md b/defects/postgresql/patch/postgresql-0007-add-new-columns-hash.md index b775d1d3a..c1cbd3488 100644 --- a/defects/postgresql/patch/postgresql-0007-add-new-columns-hash.md +++ b/defects/postgresql/patch/postgresql-0007-add-new-columns-hash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000219 # postgresql-0007 — `add_new_columns_to_pathtarget`: O(E·T) list_member scan inside loop ## Status diff --git a/defects/postgresql/patch/postgresql-0008-paraminfo-equal-hashops.md b/defects/postgresql/patch/postgresql-0008-paraminfo-equal-hashops.md index 72a45e259..3df2823ae 100644 --- a/defects/postgresql/patch/postgresql-0008-paraminfo-equal-hashops.md +++ b/defects/postgresql/patch/postgresql-0008-paraminfo-equal-hashops.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000220 # postgresql-0008 — `paraminfo_get_equal_hashops`: O(N²) list_member deduplication in Memoize path planning ## Status diff --git a/defects/postgresql/patch/postgresql-0009-type-inherits-from-visited-hash.md b/defects/postgresql/patch/postgresql-0009-type-inherits-from-visited-hash.md index 0e57f1537..9ef9d1f6c 100644 --- a/defects/postgresql/patch/postgresql-0009-type-inherits-from-visited-hash.md +++ b/defects/postgresql/patch/postgresql-0009-type-inherits-from-visited-hash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000221 # postgresql-0009 — `typeInheritsFrom`: O(V²) BFS with visited List in type coercibility check ## Status diff --git a/defects/prometheus/patch/prometheus-0002-dependencies-inverse-map.md b/defects/prometheus/patch/prometheus-0002-dependencies-inverse-map.md index 5adf0d1f2..ebdc8cf4e 100644 --- a/defects/prometheus/patch/prometheus-0002-dependencies-inverse-map.md +++ b/defects/prometheus/patch/prometheus-0002-dependencies-inverse-map.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000503 # prometheus-0002: dependencyMap.dependencies() O(R²×D) in AnalyseRules **CWE:** CWE-407 (Algorithmic Complexity — Inefficient Algorithmic Complexity) diff --git a/defects/pulsar/patch/pulsar-0001-gettopicsresult-grouped-linkedhashset.md b/defects/pulsar/patch/pulsar-0001-gettopicsresult-grouped-linkedhashset.md index 9ccbf3180..aacd4edaa 100644 --- a/defects/pulsar/patch/pulsar-0001-gettopicsresult-grouped-linkedhashset.md +++ b/defects/pulsar/patch/pulsar-0001-gettopicsresult-grouped-linkedhashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000505 # pulsar-0001: GetTopicsResult.getTopics() — ArrayList.contains() inside dedup for loop ## Defect ID diff --git a/defects/pulsar/patch/pulsar-0002-javainstancerunnable-allfields-hashset.md b/defects/pulsar/patch/pulsar-0002-javainstancerunnable-allfields-hashset.md index 93bd4564c..6972c9706 100644 --- a/defects/pulsar/patch/pulsar-0002-javainstancerunnable-allfields-hashset.md +++ b/defects/pulsar/patch/pulsar-0002-javainstancerunnable-allfields-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000506 # pulsar-0002: JavaInstanceRunnable — List.contains() inside config key validation loop ## Defect ID diff --git a/defects/pulsar/patch/pulsar-0003-persistenttopic-replicationclusters-list-hashset.md b/defects/pulsar/patch/pulsar-0003-persistenttopic-replicationclusters-list-hashset.md index 4aca47cdb..a65932cc5 100644 --- a/defects/pulsar/patch/pulsar-0003-persistenttopic-replicationclusters-list-hashset.md +++ b/defects/pulsar/patch/pulsar-0003-persistenttopic-replicationclusters-list-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000507 # pulsar-0003 — PersistentTopic: replicationClusters List.contains() O(C×R) in replication-check hot path ## Metadata diff --git a/defects/pulsar/patch/pulsar-0004-persistenttopic-shadowtopics-list-hashset.md b/defects/pulsar/patch/pulsar-0004-persistenttopic-shadowtopics-list-hashset.md index 15bfa94e5..aa8dda633 100644 --- a/defects/pulsar/patch/pulsar-0004-persistenttopic-shadowtopics-list-hashset.md +++ b/defects/pulsar/patch/pulsar-0004-persistenttopic-shadowtopics-list-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000508 # pulsar-0004 — PersistentTopic: shadowTopics List.contains() O(S×R) in checkShadowReplication() ## Metadata diff --git a/defects/pulsar/patch/pulsar-0005-partialroundrobin-cowalist-contains-hashset.md b/defects/pulsar/patch/pulsar-0005-partialroundrobin-cowalist-contains-hashset.md index 8f2ff1c75..830940d6e 100644 --- a/defects/pulsar/patch/pulsar-0005-partialroundrobin-cowalist-contains-hashset.md +++ b/defects/pulsar/patch/pulsar-0005-partialroundrobin-cowalist-contains-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000509 # pulsar-0005 — PartialRoundRobinMessageRouterImpl CopyOnWriteArrayList.contains O(N×L) → HashSet O(N) ## Classification diff --git a/defects/pulsar/patch/pulsar-deeper-CLEAN.md b/defects/pulsar/patch/pulsar-deeper-CLEAN.md index d433b645e..92eadba7d 100644 --- a/defects/pulsar/patch/pulsar-deeper-CLEAN.md +++ b/defects/pulsar/patch/pulsar-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000505 # pulsar deeper scan — CWE-407 triage ## Scan date: 2026-03-27 diff --git a/defects/pulumi/patch/pulumi-0001-package-info-required-list-contains.md b/defects/pulumi/patch/pulumi-0001-package-info-required-list-contains.md index 5eaeaecc9..04523a3b3 100644 --- a/defects/pulumi/patch/pulumi-0001-package-info-required-list-contains.md +++ b/defects/pulumi/patch/pulumi-0001-package-info-required-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000510 # pulumi-0001: package_info.go Required slice O(P×R) membership test ## Classification diff --git a/defects/python-igraph/patch/igraph-0001-max-cohesion-set.md b/defects/python-igraph/patch/igraph-0001-max-cohesion-set.md index b82a7b03c..605cbb613 100644 --- a/defects/python-igraph/patch/igraph-0001-max-cohesion-set.md +++ b/defects/python-igraph/patch/igraph-0001-max-cohesion-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000511 From: agent-blackops Date: Fri, 27 Mar 2026 00:00:00 +0000 Subject: [PATCH] clustering: replace list membership scan in CohesiveBlocks.max_cohesion with set lookup diff --git a/defects/pytorch-geometric/patch/pytorch-geometric-0001-smiles-list-index-o-n2.md b/defects/pytorch-geometric/patch/pytorch-geometric-0001-smiles-list-index-o-n2.md index 504c64ba8..aad37aea3 100644 --- a/defects/pytorch-geometric/patch/pytorch-geometric-0001-smiles-list-index-o-n2.md +++ b/defects/pytorch-geometric/patch/pytorch-geometric-0001-smiles-list-index-o-n2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000515 # pytorch-geometric-0001: smiles.py list.index() O(L×A) per molecule → O(A) with dict lookup ## File diff --git a/defects/pytorch/patch/pytorch-0001-graph-fuser-chunk-linear-search.md b/defects/pytorch/patch/pytorch-0001-graph-fuser-chunk-linear-search.md index aaa0a84a5..029bbed6d 100644 --- a/defects/pytorch/patch/pytorch-0001-graph-fuser-chunk-linear-search.md +++ b/defects/pytorch/patch/pytorch-0001-graph-fuser-chunk-linear-search.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000512 # pytorch-0001 — graph_fuser.cpp fuseChunkByReusingExistingFusedChunk O(N²) ## Location diff --git a/defects/pytorch/patch/pytorch-0002-graph-fuser-mergenode-linear-search.md b/defects/pytorch/patch/pytorch-0002-graph-fuser-mergenode-linear-search.md index 2bd8dfa14..05a8d1a81 100644 --- a/defects/pytorch/patch/pytorch-0002-graph-fuser-mergenode-linear-search.md +++ b/defects/pytorch/patch/pytorch-0002-graph-fuser-mergenode-linear-search.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000513 # pytorch-0002 — graph_fuser.cpp mergeNodeIntoGroup + tryToMoveChunk O(N²) ## Location diff --git a/defects/pytorch/patch/pytorch-0003-tracer-trace-outputs-linear-search.md b/defects/pytorch/patch/pytorch-0003-tracer-trace-outputs-linear-search.md index 80bc18a61..49b3d0889 100644 --- a/defects/pytorch/patch/pytorch-0003-tracer-trace-outputs-linear-search.md +++ b/defects/pytorch/patch/pytorch-0003-tracer-trace-outputs-linear-search.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000514 # pytorch-0003 — python_function.cpp tracer subgraph construction O(N²) ## Location diff --git a/defects/qemu/patch/qemu-0001-savevm-find-se-hash.md b/defects/qemu/patch/qemu-0001-savevm-find-se-hash.md index 4430f7cbc..4102763b1 100644 --- a/defects/qemu/patch/qemu-0001-savevm-find-se-hash.md +++ b/defects/qemu/patch/qemu-0001-savevm-find-se-hash.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000516 # qemu-0001: savevm find_se O(N²) during VM migration load ## Classification diff --git a/defects/qemu/patch/qemu-CLEAN-net-assign-name.md b/defects/qemu/patch/qemu-CLEAN-net-assign-name.md index 5525abd61..11176d5b7 100644 --- a/defects/qemu/patch/qemu-CLEAN-net-assign-name.md +++ b/defects/qemu/patch/qemu-CLEAN-net-assign-name.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000516 # QEMU net/net.c assign_name — NOT CWE-407 (CLEAN) ## Target: `net/net.c` — `assign_name()` diff --git a/defects/quarkus/patch/quarkus-0001-beaninfo-bound-interceptors-contains.md b/defects/quarkus/patch/quarkus-0001-beaninfo-bound-interceptors-contains.md index 74cd6b404..356277e08 100644 --- a/defects/quarkus/patch/quarkus-0001-beaninfo-bound-interceptors-contains.md +++ b/defects/quarkus/patch/quarkus-0001-beaninfo-bound-interceptors-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000517 # quarkus-0001: BeanInfo.getBoundInterceptors — O(I²) bound.contains in nested loops ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/quarkus/patch/quarkus-0002-componentsprovider-isdependency-contains.md b/defects/quarkus/patch/quarkus-0002-componentsprovider-isdependency-contains.md index 9d7459d4b..dec23e972 100644 --- a/defects/quarkus/patch/quarkus-0002-componentsprovider-isdependency-contains.md +++ b/defects/quarkus/patch/quarkus-0002-componentsprovider-isdependency-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000518 # quarkus-0002: ComponentsProviderGenerator.isDependency — O(B×D) dependants.contains in loop ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/rabbitmq/patch/rabbitmq-deeper-CLEAN.md b/defects/rabbitmq/patch/rabbitmq-deeper-CLEAN.md index 0a32d57ed..0c026fb06 100644 --- a/defects/rabbitmq/patch/rabbitmq-deeper-CLEAN.md +++ b/defects/rabbitmq/patch/rabbitmq-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000237 # RabbitMQ CWE-407 Scan — CLEAN (deeper scan, beyond rmq-0004) **Date:** 2026-03-27 diff --git a/defects/rabbitmq/patch/rmq-0005-export-binding-qnames-sets.md b/defects/rabbitmq/patch/rmq-0005-export-binding-qnames-sets.md index 499bba95a..915c039ca 100644 --- a/defects/rabbitmq/patch/rmq-0005-export-binding-qnames-sets.md +++ b/defects/rabbitmq/patch/rmq-0005-export-binding-qnames-sets.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000520 # rmq-0005: rabbit_mgmt_wm_definitions export_binding O(B×Q) → O(B+Q) ## Location diff --git a/defects/raylib/patch/raylib-0002-random-sequence-hashset-dedup.md b/defects/raylib/patch/raylib-0002-random-sequence-hashset-dedup.md index 77f4cc85f..27e7778b3 100644 --- a/defects/raylib/patch/raylib-0002-random-sequence-hashset-dedup.md +++ b/defects/raylib/patch/raylib-0002-random-sequence-hashset-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000522 # raylib-0002: LoadRandomSequence O(n²) dedup — CWE-407 **Severity:** MEDIUM diff --git a/defects/redis/patch/redis-0004-acl-channel-check-hashset.md b/defects/redis/patch/redis-0004-acl-channel-check-hashset.md index ae59a1884..441b93253 100644 --- a/defects/redis/patch/redis-0004-acl-channel-check-hashset.md +++ b/defects/redis/patch/redis-0004-acl-channel-check-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000523 # redis-0004: ACLCheckChannelAgainstList O(C×P) per pubsub command → O(C) ## Classification diff --git a/defects/rocksdb/patch/rocksdb-001-lock-txn-ids-linear-scan.md b/defects/rocksdb/patch/rocksdb-001-lock-txn-ids-linear-scan.md index 9d610f163..b001cd330 100644 --- a/defects/rocksdb/patch/rocksdb-001-lock-txn-ids-linear-scan.md +++ b/defects/rocksdb/patch/rocksdb-001-lock-txn-ids-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000524 # rocksdb-001: LockInfo.txn_ids linear scan — O(T²) shared-lock churn ## Severity: HIGH diff --git a/defects/ros2/patch/ros2-0001-parameter-events-filter-names-find.md b/defects/ros2/patch/ros2-0001-parameter-events-filter-names-find.md index 8c9db07dd..50cc933c8 100644 --- a/defects/ros2/patch/ros2-0001-parameter-events-filter-names-find.md +++ b/defects/ros2/patch/ros2-0001-parameter-events-filter-names-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000525 # ros2-0001: ParameterEventsFilter — O(N×P) std::find on names vector inside parameter loop ## Location diff --git a/defects/ros2/patch/ros2-0002-list-parameters-prefixes-find.md b/defects/ros2/patch/ros2-0002-list-parameters-prefixes-find.md index 696defa96..a097f4f62 100644 --- a/defects/ros2/patch/ros2-0002-list-parameters-prefixes-find.md +++ b/defects/ros2/patch/ros2-0002-list-parameters-prefixes-find.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000526 # ros2-0002: NodeParameters::list_parameters() — O(P²) std::find on result.prefixes inside parameter loop ## Location diff --git a/defects/rustc/patch/rustc-0003-target-feature-call-safe.md b/defects/rustc/patch/rustc-0003-target-feature-call-safe.md index 13863af35..e58268834 100644 --- a/defects/rustc/patch/rustc-0003-target-feature-call-safe.md +++ b/defects/rustc/patch/rustc-0003-target-feature-call-safe.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000268 # rustc-0003: CWE-407 — O(C×B) nested Vec scan in is_target_feature_call_safe **Severity:** MEDIUM diff --git a/defects/rustc/patch/rustc-0004-finalize-imports-ambiguity-errors-linear-scan.md b/defects/rustc/patch/rustc-0004-finalize-imports-ambiguity-errors-linear-scan.md index 06ef34e6d..7777e8fba 100644 --- a/defects/rustc/patch/rustc-0004-finalize-imports-ambiguity-errors-linear-scan.md +++ b/defects/rustc/patch/rustc-0004-finalize-imports-ambiguity-errors-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000527 # rustc-0004: CWE-407 — O(I×A) repeated Vec linear scan in finalize_imports **Severity:** MEDIUM diff --git a/defects/rustc/patch/rustc-imports-fulfill-deeper-CLEAN.md b/defects/rustc/patch/rustc-imports-fulfill-deeper-CLEAN.md index 05240eb10..ae3d1c599 100644 --- a/defects/rustc/patch/rustc-imports-fulfill-deeper-CLEAN.md +++ b/defects/rustc/patch/rustc-imports-fulfill-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000267 # rustc deeper scan — fulfill.rs CLEAN **Scan date:** 2026-03-27 diff --git a/defects/samza/patch/samza-CLEAN.md b/defects/samza/patch/samza-CLEAN.md index 32fab750a..a05ad0312 100644 --- a/defects/samza/patch/samza-CLEAN.md +++ b/defects/samza/patch/samza-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000528 # samza — CLEAN Scanned: diff --git a/defects/scylladb/patch/scylladb-0001-storage-proxy-intersection-vnode-loop.md b/defects/scylladb/patch/scylladb-0001-storage-proxy-intersection-vnode-loop.md index b0a3f919d..dedeed905 100644 --- a/defects/scylladb/patch/scylladb-0001-storage-proxy-intersection-vnode-loop.md +++ b/defects/scylladb/patch/scylladb-0001-storage-proxy-intersection-vnode-loop.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000529 # scylladb-0001 — storage_proxy::intersection: O(L₁×L₂) linear scan in vnode range loop **Project:** ScyllaDB diff --git a/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md b/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md index cb6018f93..405e468cf 100644 --- a/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md +++ b/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000532 # sklearn-0001: HistGradientBoosting _check_categories — O(n²) feature_names.index in loop **Severity:** MEDIUM diff --git a/defects/solr/patch/solr-001-cluster-status-live-nodes-list-contains.md b/defects/solr/patch/solr-001-cluster-status-live-nodes-list-contains.md index da71210df..7e51c33b2 100644 --- a/defects/solr/patch/solr-001-cluster-status-live-nodes-list-contains.md +++ b/defects/solr/patch/solr-001-cluster-status-live-nodes-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000533 # solr-001: ClusterStatus O(n²) liveNodes.contains in crossCheckReplicaStateWithLiveNodes ## Classification diff --git a/defects/solr/patch/solr-002-active-replica-watcher-list-contains.md b/defects/solr/patch/solr-002-active-replica-watcher-list-contains.md index 7e84cfa81..d187371e3 100644 --- a/defects/solr/patch/solr-002-active-replica-watcher-list-contains.md +++ b/defects/solr/patch/solr-002-active-replica-watcher-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000533 # solr-002: ActiveReplicaWatcher O(n²) replicaIds/solrCoreNames.contains in state-change loop ## Classification diff --git a/defects/solr/patch/solr-003-split-shard-cmd-subslices-list-contains.md b/defects/solr/patch/solr-003-split-shard-cmd-subslices-list-contains.md index ef71fa2ab..5f51f196b 100644 --- a/defects/solr/patch/solr-003-split-shard-cmd-subslices-list-contains.md +++ b/defects/solr/patch/solr-003-split-shard-cmd-subslices-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000533 # solr-003: SplitShardCmd O(n²) subSlices.contains in loop over all collection slices ## Classification diff --git a/defects/spark/patch/spark-0002-dagscheduler-listbuffer-remove0-arraydeque.md b/defects/spark/patch/spark-0002-dagscheduler-listbuffer-remove0-arraydeque.md index 7a2e62b2c..f57697e63 100644 --- a/defects/spark/patch/spark-0002-dagscheduler-listbuffer-remove0-arraydeque.md +++ b/defects/spark/patch/spark-0002-dagscheduler-listbuffer-remove0-arraydeque.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000534 # spark-0002 — DAGScheduler BFS queues: ListBuffer.remove(0) is O(N) → O(N²) total **Severity:** HIGH diff --git a/defects/spark/patch/spark-0003-ticket.md b/defects/spark/patch/spark-0003-ticket.md index 313b12c52..1a0991e3d 100644 --- a/defects/spark/patch/spark-0003-ticket.md +++ b/defects/spark/patch/spark-0003-ticket.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000291 # spark-0003: Spark Standalone Master — completedApps ArrayBuffer.contains() O(n²) on worker failure ## Severity diff --git a/defects/spark/patch/spark-0004-dagscheduler-waitingstages-parents-list-contains.md b/defects/spark/patch/spark-0004-dagscheduler-waitingstages-parents-list-contains.md index 50dc5faa7..09d0c4c6f 100644 --- a/defects/spark/patch/spark-0004-dagscheduler-waitingstages-parents-list-contains.md +++ b/defects/spark/patch/spark-0004-dagscheduler-waitingstages-parents-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000535 # spark-0004 — Spark DAGScheduler: waitingStages.filter(_.parents.contains(parent)) O(W×P) on every stage completion ## Metadata diff --git a/defects/spark/patch/spark-deeper-CLEAN.md b/defects/spark/patch/spark-deeper-CLEAN.md index 4da49f377..68e12e239 100644 --- a/defects/spark/patch/spark-deeper-CLEAN.md +++ b/defects/spark/patch/spark-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000290 # spark-deeper — Scheduler + Catalyst + Physical Plan + Storage + Shuffle CLEAN ## Areas Scanned diff --git a/defects/spidermonkey/patch/sm-0002-unrollloops-remapper-hashmap.md b/defects/spidermonkey/patch/sm-0002-unrollloops-remapper-hashmap.md index 44143d538..cf5b00d25 100644 --- a/defects/spidermonkey/patch/sm-0002-unrollloops-remapper-hashmap.md +++ b/defects/spidermonkey/patch/sm-0002-unrollloops-remapper-hashmap.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000536 # SM-0002: MDefinitionRemapper::lookup() O(N) linear scan in loop-unrolling phase **File:** `js/src/jit/UnrollLoops.cpp` diff --git a/defects/spidermonkey/patch/sm-0003-simpleset-hashset.md b/defects/spidermonkey/patch/sm-0003-simpleset-hashset.md index 17f9f9533..7fb742fe8 100644 --- a/defects/spidermonkey/patch/sm-0003-simpleset-hashset.md +++ b/defects/spidermonkey/patch/sm-0003-simpleset-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000537 # SM-0003: SimpleSet::contains() O(N) linear scan in loop-unrolling phase **File:** `js/src/jit/UnrollLoops.cpp` diff --git a/defects/spidermonkey/patch/sm-0004-modules-exportnames-hashset.md b/defects/spidermonkey/patch/sm-0004-modules-exportnames-hashset.md index 0e954d8d5..224282b5e 100644 --- a/defects/spidermonkey/patch/sm-0004-modules-exportnames-hashset.md +++ b/defects/spidermonkey/patch/sm-0004-modules-exportnames-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000538 # SM-0004: Modules.cpp ContainsElement(exportedNames) O(N) linear scan in GetExportedNames **File:** `js/src/vm/Modules.cpp` diff --git a/defects/spring/patch/spring-0005-annotation-type-mapping-aliases-contains.md b/defects/spring/patch/spring-0005-annotation-type-mapping-aliases-contains.md index 96737c73b..45f841225 100644 --- a/defects/spring/patch/spring-0005-annotation-type-mapping-aliases-contains.md +++ b/defects/spring/patch/spring-0005-annotation-type-mapping-aliases-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000540 # spring-0001: AnnotationTypeMapping — O(A²×M) aliases.contains in nested loops ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/spring/patch/spring-0006-version-resource-resolver-hashset.md b/defects/spring/patch/spring-0006-version-resource-resolver-hashset.md index 33cd72bf2..91d59ecbd 100644 --- a/defects/spring/patch/spring-0006-version-resource-resolver-hashset.md +++ b/defects/spring/patch/spring-0006-version-resource-resolver-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000400 +# UNDF: UNDF-2026-000000541 # spring-0006: VersionResourceResolver — O(N²) patternsList.contains() in addFixedVersionStrategy() ## CWE-407 — Algorithmic Complexity: Linear Membership Test in Loop diff --git a/defects/spring/patch/spring-deeper-CLEAN.md b/defects/spring/patch/spring-deeper-CLEAN.md index ba0121f0f..d6b5ab49f 100644 --- a/defects/spring/patch/spring-deeper-CLEAN.md +++ b/defects/spring/patch/spring-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000295 # Spring Framework — Deeper CWE-407 Scan CLEAN Report ## Scan Date diff --git a/defects/sqlalchemy/patch/sqlalchemy-0003-evaluated-keys-set.md b/defects/sqlalchemy/patch/sqlalchemy-0003-evaluated-keys-set.md index 4c7e9615b..30423ffcb 100644 --- a/defects/sqlalchemy/patch/sqlalchemy-0003-evaluated-keys-set.md +++ b/defects/sqlalchemy/patch/sqlalchemy-0003-evaluated-keys-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000542 # sqlalchemy-0003: evaluated_keys list → set in _apply_evaluators() ## Severity diff --git a/defects/sqlite/patch/sqlite-0003-fk-column-resolution.md b/defects/sqlite/patch/sqlite-0003-fk-column-resolution.md index 30cf0f1c8..71c003ff2 100644 --- a/defects/sqlite/patch/sqlite-0003-fk-column-resolution.md +++ b/defects/sqlite/patch/sqlite-0003-fk-column-resolution.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000300 # sqlite-0003 — `sqlite3CreateForeignKey`: O(F×C) column resolution with `sqlite3StrICmp` inside nested loop ## Status diff --git a/defects/starrocks/patch/starrocks-0001-mv-rewriter-tablelist-hashset.md b/defects/starrocks/patch/starrocks-0001-mv-rewriter-tablelist-hashset.md index f75bf272d..9b62bafee 100644 --- a/defects/starrocks/patch/starrocks-0001-mv-rewriter-tablelist-hashset.md +++ b/defects/starrocks/patch/starrocks-0001-mv-rewriter-tablelist-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000543 # starrocks-0001: MaterializedViewRewriter.getTableToRelationid — List.contains in column-ref loop → O(N×T) ## Classification diff --git a/defects/strongswan/patch/strongswan-0001-proposal-select-nested-linear-scan.md b/defects/strongswan/patch/strongswan-0001-proposal-select-nested-linear-scan.md index f9789cc6a..569c8aa41 100644 --- a/defects/strongswan/patch/strongswan-0001-proposal-select-nested-linear-scan.md +++ b/defects/strongswan/patch/strongswan-0001-proposal-select-nested-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000544 # strongswan-0001: CWE-407 O(P²×T×A²) nested linear scans in proposal_select / select_algo ## Severity: HIGH diff --git a/defects/swift/patch/swift-0002-requirement-machine-set.md b/defects/swift/patch/swift-0002-requirement-machine-set.md index 0c924b237..dadef88d6 100644 --- a/defects/swift/patch/swift-0002-requirement-machine-set.md +++ b/defects/swift/patch/swift-0002-requirement-machine-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000546 # swift-0001: isInMinimizationDomain — O(P) linear scan in O(R) rule loop ## Severity: HIGH diff --git a/defects/swift/patch/swift-deeper-CLEAN.md b/defects/swift/patch/swift-deeper-CLEAN.md index 419f5920c..51343ddd7 100644 --- a/defects/swift/patch/swift-deeper-CLEAN.md +++ b/defects/swift/patch/swift-deeper-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000545 # Swift Sema deeper scan — CLEAN **Scan date:** 2026-03-27 diff --git a/defects/systemd/patch/systemd-0001-strv-extend-dedup-hashset.md b/defects/systemd/patch/systemd-0001-strv-extend-dedup-hashset.md index 3568837b4..a6db5a6b9 100644 --- a/defects/systemd/patch/systemd-0001-strv-extend-dedup-hashset.md +++ b/defects/systemd/patch/systemd-0001-strv-extend-dedup-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000547 # systemd-0001: strv_extend_strv filter_duplicates O(N²) — CWE-407 ## Severity diff --git a/defects/systemd/patch/systemd-0002-unit-file-get-list-states-hashset.md b/defects/systemd/patch/systemd-0002-unit-file-get-list-states-hashset.md index 7206384e5..bf4b680f7 100644 --- a/defects/systemd/patch/systemd-0002-unit-file-get-list-states-hashset.md +++ b/defects/systemd/patch/systemd-0002-unit-file-get-list-states-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000548 # systemd-0002: unit_file_get_list states filter O(U×S) — CWE-407 ## Severity diff --git a/defects/tcl/patch/tcl-0001-do-import-export-set.md b/defects/tcl/patch/tcl-0001-do-import-export-set.md index e23774448..7d55c426c 100644 --- a/defects/tcl/patch/tcl-0001-do-import-export-set.md +++ b/defects/tcl/patch/tcl-0001-do-import-export-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000549 # tcl-0001: DoImport O(C×P) export pattern scan per namespace import ## Classification diff --git a/defects/tcpdump/patch/tcpdump-CLEAN.md b/defects/tcpdump/patch/tcpdump-CLEAN.md index 7b9bbdee4..5b91942e0 100644 --- a/defects/tcpdump/patch/tcpdump-CLEAN.md +++ b/defects/tcpdump/patch/tcpdump-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000550 # tcpdump — CWE-407 scan result: CLEAN **Scan date:** 2026-03-27 diff --git a/defects/tensorflow/patch/tensorflow-0001-execute-host-memory-args-linear-search.md b/defects/tensorflow/patch/tensorflow-0001-execute-host-memory-args-linear-search.md index 40919b423..211bb1add 100644 --- a/defects/tensorflow/patch/tensorflow-0001-execute-host-memory-args-linear-search.md +++ b/defects/tensorflow/patch/tensorflow-0001-execute-host-memory-args-linear-search.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000551 # tensorflow-0001 — execute.cc IsHostMemoryArg O(N²) per-op dispatch ## Location diff --git a/defects/terraform/patch/tf-aws-0001-cloudformation-stackset-orgid-scan.md b/defects/terraform/patch/tf-aws-0001-cloudformation-stackset-orgid-scan.md index 532c5d6e8..805d8c41d 100644 --- a/defects/terraform/patch/tf-aws-0001-cloudformation-stackset-orgid-scan.md +++ b/defects/terraform/patch/tf-aws-0001-cloudformation-stackset-orgid-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000307 # tf-aws-0001 — Terraform AWS Provider: CloudFormation StackSet org-ID filter O(S×O) **Severity:** MEDIUM diff --git a/defects/threejs/patch/threejs-0006-eventdispatcher-addeventlistener-set.md b/defects/threejs/patch/threejs-0006-eventdispatcher-addeventlistener-set.md index 182da28da..2ec2cf592 100644 --- a/defects/threejs/patch/threejs-0006-eventdispatcher-addeventlistener-set.md +++ b/defects/threejs/patch/threejs-0006-eventdispatcher-addeventlistener-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000552 # threejs-0006: EventDispatcher.addEventListener() O(N²) via indexOf dedup on every add **File:** `src/core/EventDispatcher.js` diff --git a/defects/thrift/patch/thrift-0001-cpp-generator-struct-members-vector-find-o-n2.md b/defects/thrift/patch/thrift-0001-cpp-generator-struct-members-vector-find-o-n2.md index 0341af4a3..efa2b36c2 100644 --- a/defects/thrift/patch/thrift-0001-cpp-generator-struct-members-vector-find-o-n2.md +++ b/defects/thrift/patch/thrift-0001-cpp-generator-struct-members-vector-find-o-n2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000553 # thrift-0001: t_cpp_generator is_struct_storage_not_throwing() std::find O(M²) → O(1) with unordered_set ## File diff --git a/defects/tikv/patch/tikv-CLEAN.md b/defects/tikv/patch/tikv-CLEAN.md index 70ac4e4d3..3d2a8f948 100644 --- a/defects/tikv/patch/tikv-CLEAN.md +++ b/defects/tikv/patch/tikv-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000554 # TiKV CWE-407 Scan — CLEAN **Date:** 2026-03-27 diff --git a/defects/tokio/patch/tokio-0001-any-delimiter-codec-lookup-table.md b/defects/tokio/patch/tokio-0001-any-delimiter-codec-lookup-table.md index 1917c8e06..6eb79821d 100644 --- a/defects/tokio/patch/tokio-0001-any-delimiter-codec-lookup-table.md +++ b/defects/tokio/patch/tokio-0001-any-delimiter-codec-lookup-table.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000555 # tokio-0001: AnyDelimiterCodec seek_delimiters Vec::contains() O(N×D) per frame decode **Severity:** HIGH diff --git a/defects/tokio/patch/tokio-CLEAN.md b/defects/tokio/patch/tokio-CLEAN.md index 8869a48c7..4fc56eea7 100644 --- a/defects/tokio/patch/tokio-CLEAN.md +++ b/defects/tokio/patch/tokio-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000555 # tokio — CWE-407 Scan Result: CLEAN **Date:** 2026-03-27 diff --git a/defects/tomcat/patch/tomcat-0002-tribes-arrays-merge.md b/defects/tomcat/patch/tomcat-0002-tribes-arrays-merge.md index 726965b57..0158cdf0b 100644 --- a/defects/tomcat/patch/tomcat-0002-tribes-arrays-merge.md +++ b/defects/tomcat/patch/tomcat-0002-tribes-arrays-merge.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000556 ## tomcat-0002 — CWE-407: Arrays.merge() ArrayList.contains() O(M×N) in Tribes member deduplication **File:** `java/org/apache/catalina/tribes/util/Arrays.java` diff --git a/defects/tomcat/patch/tomcat-CLEAN-connectorandmapper.md b/defects/tomcat/patch/tomcat-CLEAN-connectorandmapper.md index a84f66569..e77ee1429 100644 --- a/defects/tomcat/patch/tomcat-CLEAN-connectorandmapper.md +++ b/defects/tomcat/patch/tomcat-CLEAN-connectorandmapper.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000315 ## Tomcat — CWE-407 scan result: CLEAN for connector/mapper/session (beyond tomcat-0002) Files scanned: diff --git a/defects/traefik/patch/traefik-0001-forwarded-header-slices-contains.md b/defects/traefik/patch/traefik-0001-forwarded-header-slices-contains.md index a4a081716..7e11b0c7a 100644 --- a/defects/traefik/patch/traefik-0001-forwarded-header-slices-contains.md +++ b/defects/traefik/patch/traefik-0001-forwarded-header-slices-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000557 # traefik-0001 — XForwarded.removeConnectionHeaders slices.Contains O(H×F) per request ## Ecosystem diff --git a/defects/traefik/patch/traefik-0002-tracing-safe-query-params.md b/defects/traefik/patch/traefik-0002-tracing-safe-query-params.md index b3d11950c..b68b5f1af 100644 --- a/defects/traefik/patch/traefik-0002-tracing-safe-query-params.md +++ b/defects/traefik/patch/traefik-0002-tracing-safe-query-params.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000558 # traefik-0002 — Tracer.safeURL slices.Contains O(Q×P) per request ## Ecosystem diff --git a/defects/traefik/patch/traefik-0003-runtime-entrypoints-slices-contains.md b/defects/traefik/patch/traefik-0003-runtime-entrypoints-slices-contains.md index dfc7bb2fa..2ee9a52fe 100644 --- a/defects/traefik/patch/traefik-0003-runtime-entrypoints-slices-contains.md +++ b/defects/traefik/patch/traefik-0003-runtime-entrypoints-slices-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000559 # traefik-0003 — runtime PopulateUsedBy entryPoints slices.Contains O(R×M×E) config load ## Ecosystem diff --git a/defects/trino/patch/trino-0001-pushdown-deref-join-immutableset.md b/defects/trino/patch/trino-0001-pushdown-deref-join-immutableset.md index d071a0e80..13ee76b91 100644 --- a/defects/trino/patch/trino-0001-pushdown-deref-join-immutableset.md +++ b/defects/trino/patch/trino-0001-pushdown-deref-join-immutableset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000560 # trino-0001: PushDownDereferenceThroughJoin — List.contains in stream filter → O(N²) ## Classification diff --git a/defects/undertow/patch/undertow-0001-websocket-subprotocol-negotiation.md b/defects/undertow/patch/undertow-0001-websocket-subprotocol-negotiation.md index 2171bd42a..e22f2d7fd 100644 --- a/defects/undertow/patch/undertow-0001-websocket-subprotocol-negotiation.md +++ b/defects/undertow/patch/undertow-0001-websocket-subprotocol-negotiation.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000561 ## undertow-0001 — CWE-407: DefaultContainerConfigurator.getNegotiatedSubprotocol() List.contains() O(R×S) per WebSocket handshake **File:** `websockets-jsr/src/main/java/io/undertow/websockets/jsr/DefaultContainerConfigurator.java` diff --git a/defects/uvicorn/patch/uvicorn-CLEAN.md b/defects/uvicorn/patch/uvicorn-CLEAN.md index a83720ece..d19327547 100644 --- a/defects/uvicorn/patch/uvicorn-CLEAN.md +++ b/defects/uvicorn/patch/uvicorn-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000562 # uvicorn — CWE-407 Scan: CLEAN **Date:** 2026-03-27 diff --git a/defects/uwsgi/patch/uwsgi-0001-http-header-dedup-list.md b/defects/uwsgi/patch/uwsgi-0001-http-header-dedup-list.md index de8eef42e..d6f79b020 100644 --- a/defects/uwsgi/patch/uwsgi-0001-http-header-dedup-list.md +++ b/defects/uwsgi/patch/uwsgi-0001-http-header-dedup-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000563 # uwsgi-0001: HTTP Header Duplicate Detection O(H²) — CWE-407 **Severity:** HIGH diff --git a/defects/v8/patch/v8-0002-intl-canonicalize-locale-list-unordered-set.md b/defects/v8/patch/v8-0002-intl-canonicalize-locale-list-unordered-set.md index f2300b05e..8c3b0e969 100644 --- a/defects/v8/patch/v8-0002-intl-canonicalize-locale-list-unordered-set.md +++ b/defects/v8/patch/v8-0002-intl-canonicalize-locale-list-unordered-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000564 # v8-0002 — objects/intl: CanonicalizeLocaleList seen-list O(N²) → O(N) ## Metadata diff --git a/defects/v8/patch/v8-0003-revectorizer-slptree-load-chain-unordered-set.md b/defects/v8/patch/v8-0003-revectorizer-slptree-load-chain-unordered-set.md index 0b1ba2567..1c23c8340 100644 --- a/defects/v8/patch/v8-0003-revectorizer-slptree-load-chain-unordered-set.md +++ b/defects/v8/patch/v8-0003-revectorizer-slptree-load-chain-unordered-set.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000565 # v8-0003 — compiler/revectorizer: SLPTree::TryReduceLoadChain loads O(L×N) → O(L) ## Metadata diff --git a/defects/valhalla/patch/valhalla-0001-linkclassification-issliplane-linear-scan.md b/defects/valhalla/patch/valhalla-0001-linkclassification-issliplane-linear-scan.md index 5f2b9180d..54353768f 100644 --- a/defects/valhalla/patch/valhalla-0001-linkclassification-issliplane-linear-scan.md +++ b/defects/valhalla/patch/valhalla-0001-linkclassification-issliplane-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000566 # valhalla-0001: linkclassification.cc — IsSlipLane() nested linear scan O(F×R) ## File diff --git a/defects/varnish/patch/varnish-0002-ban-reload-dedup.md b/defects/varnish/patch/varnish-0002-ban-reload-dedup.md index dafb3db7d..f17f0d319 100644 --- a/defects/varnish/patch/varnish-0002-ban-reload-dedup.md +++ b/defects/varnish/patch/varnish-0002-ban-reload-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000567 # varnish-0002: BAN_Reload O(B²) dedup scan via ban_equal memcmp ## Severity diff --git a/defects/varnish/patch/varnish-0003-vmod-cookie-filter-hashset.md b/defects/varnish/patch/varnish-0003-vmod-cookie-filter-hashset.md index a65d6fa03..6065cda50 100644 --- a/defects/varnish/patch/varnish-0003-vmod-cookie-filter-hashset.md +++ b/defects/varnish/patch/varnish-0003-vmod-cookie-filter-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000568 # varnish-0003: vmod_cookie filter_cookies O(C×L) → O(C+L) with hash set ## Classification diff --git a/defects/vault/patch/vault-0001-identity-group-membership-linear-scan.md b/defects/vault/patch/vault-0001-identity-group-membership-linear-scan.md index 34a5ad804..47563b0f7 100644 --- a/defects/vault/patch/vault-0001-identity-group-membership-linear-scan.md +++ b/defects/vault/patch/vault-0001-identity-group-membership-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000569 # vault-0001 — HashiCorp Vault: sanitizeAndUpsertGroup O(G²) group membership test **Severity:** HIGH diff --git a/defects/vertx/patch/vertx-0001-ha-manager-nodes-list.md b/defects/vertx/patch/vertx-0001-ha-manager-nodes-list.md index 492a47766..d9fa7b48d 100644 --- a/defects/vertx/patch/vertx-0001-ha-manager-nodes-list.md +++ b/defects/vertx/patch/vertx-0001-ha-manager-nodes-list.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000570 # vertx-0001 — HAManager nodeLeft() nodes List.contains O(C²) in cluster failover scan **Classification:** CWE-407 Algorithmic Complexity — Inefficient Membership Test diff --git a/defects/victoria-metrics/patch/victoria-metrics-0001-streamaggr-label-filter-map.md b/defects/victoria-metrics/patch/victoria-metrics-0001-streamaggr-label-filter-map.md index 17e9a67bd..17fc67d26 100644 --- a/defects/victoria-metrics/patch/victoria-metrics-0001-streamaggr-label-filter-map.md +++ b/defects/victoria-metrics/patch/victoria-metrics-0001-streamaggr-label-filter-map.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000330 # victoria-metrics-0001 — `streamaggr`: O(L×K) `slices.Contains` inside `Push()` hot loop ## Status diff --git a/defects/vim/patch/vim-0001-insexpand-compl-dedup-linear-scan.md b/defects/vim/patch/vim-0001-insexpand-compl-dedup-linear-scan.md index 3e62441ee..8d340e7c5 100644 --- a/defects/vim/patch/vim-0001-insexpand-compl-dedup-linear-scan.md +++ b/defects/vim/patch/vim-0001-insexpand-compl-dedup-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000571 # vim-0001: ins_compl_add linked-list linear scan O(N²) in insert-mode completion ## Metadata diff --git a/defects/vim/patch/vim-0002-autocmd-au-find-group-linear-scan.md b/defects/vim/patch/vim-0002-autocmd-au-find-group-linear-scan.md index 56683cb7d..69c50bb6e 100644 --- a/defects/vim/patch/vim-0002-autocmd-au-find-group-linear-scan.md +++ b/defects/vim/patch/vim-0002-autocmd-au-find-group-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000572 # vim-0002: au_find_group() O(G) linear scan called per item in autocmd_add_or_delete loop ## Metadata diff --git a/defects/waitress/patch/waitress-CLEAN.md b/defects/waitress/patch/waitress-CLEAN.md index 248f5d893..be4bf829c 100644 --- a/defects/waitress/patch/waitress-CLEAN.md +++ b/defects/waitress/patch/waitress-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000573 # waitress — CWE-407 Scan: CLEAN **Date:** 2026-03-27 diff --git a/defects/wireshark/patch/wireshark-CLEAN.md b/defects/wireshark/patch/wireshark-CLEAN.md index 64d753d16..715e705c0 100644 --- a/defects/wireshark/patch/wireshark-CLEAN.md +++ b/defects/wireshark/patch/wireshark-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000341 # wireshark — CWE-407 scan result: CLEAN (beyond wireshark-0001) **Scan date:** 2026-03-27 diff --git a/defects/wolfssl/patch/wolfssl-0001-alpn-find-match.md b/defects/wolfssl/patch/wolfssl-0001-alpn-find-match.md index 42e527973..081f6abb4 100644 --- a/defects/wolfssl/patch/wolfssl-0001-alpn-find-match.md +++ b/defects/wolfssl/patch/wolfssl-0001-alpn-find-match.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000576 # wolfssl-0001: CWE-407 O(C×S) ALPN selection in ALPN_find_match ## Severity: MEDIUM diff --git a/defects/yugabyte/patch/yugabyte-0001-getxreplstreamsfortable-std-find-loop.md b/defects/yugabyte/patch/yugabyte-0001-getxreplstreamsfortable-std-find-loop.md index 60fbc168a..2cc0a98f2 100644 --- a/defects/yugabyte/patch/yugabyte-0001-getxreplstreamsfortable-std-find-loop.md +++ b/defects/yugabyte/patch/yugabyte-0001-getxreplstreamsfortable-std-find-loop.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000577 # yugabyte-0001 — GetXReplStreamsForTable: std::find on table_id list inside per-table loop **Project:** YugabyteDB diff --git a/defects/zig/patch/zig-scan-notes.md b/defects/zig/patch/zig-scan-notes.md index c8227eaf1..843dcc87b 100644 --- a/defects/zig/patch/zig-scan-notes.md +++ b/defects/zig/patch/zig-scan-notes.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000578 # Zig CWE-407 Scan — CLEAN ## Date diff --git a/defects/zsh/patch/zsh-CLEAN.md b/defects/zsh/patch/zsh-CLEAN.md index 393f9fcb7..54b746d38 100644 --- a/defects/zsh/patch/zsh-CLEAN.md +++ b/defects/zsh/patch/zsh-CLEAN.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000579 # zsh — CLEAN ## Scan Date diff --git a/whitepaper/MD5SUMS b/whitepaper/MD5SUMS index 1ca1cf96d..660bad8ad 100644 --- a/whitepaper/MD5SUMS +++ b/whitepaper/MD5SUMS @@ -3,7 +3,7 @@ ba0de5d1546aa2971492f74616f13f47 full-paper.pdf 3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf 5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf -69139fff5fafe606f9e048987b4a1544 undefect-cwe407-2026-03-27.pdf +791d5fd391e5f6186f59848004fcf204 undefect-cwe407-2026-03-27.pdf ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf 818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf diff --git a/whitepaper/full-paper.md b/whitepaper/full-paper.md index f696ae02d..842a9ac48 100644 --- a/whitepaper/full-paper.md +++ b/whitepaper/full-paper.md @@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint. 4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use Code propagates according to its kind — clean architecture begets clean implementations, -elegant solutions inspire elegant variations. The process of generating 601 validated +elegant solutions inspire elegant variations. The process of generating 603 validated defect patches across 240 ecosystems in a single research wave demonstrates how truth, properly seeded, multiplies. Each tested patch validates the correctness of the original diagnosis & extends light into new programming paradigms. @@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve confirmed site — compiler, routing, database, build tool, event streaming, web framework, query optimizer, and browser runtime. -**601 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). +**603 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). No language left behind. @@ -668,12 +668,14 @@ stacks, Spark schemas — this is the dominant build cost. | bird-0004 | BIRD routing | `filter/data.c:421` — `clist_filter`/`eclist_filter`/`lclist_filter` T_CLIST branch O(L×S) per-route community delete; fix: `HashSet` from filter set (125×) | **PATCHED** | | bazel-0001 | Bazel | `analysis/AspectCollection.java:332` — `ArrayList` backwards scan in `validateDuplicateAspect()`; O(n²) per aspect propagation path | **PATCHED** | | bazel-0002 | Bazel | `analysis/AspectCollection.java:294` — `deps.keySet()` full iteration grows per step in `create()` double loop; O(n²) per dependency edge | **PATCHED** | +| bazel-0003 | Bazel | `rules/cpp/FeatureSelection.java:159` — `enabledActivatablesInOrder ImmutableList.contains()` O(P×S×L) in provides-conflict check; called per action type per C++ target; fix: `HashSet` pre-built (80×) | **PATCHED** | | odl-0001 | OpenDaylight | `frm/impl/DevicesGroupRegistry.java:21` — `ArrayList.contains()` in group reconciliation loop; fires every switch connect/reconnect | **PATCHED** | | httpd-0001 | Apache httpd | `modules/proxy/mod_proxy_balancer.c:216,542` — `strcmp` scan over worker array per sticky-session request; O(W) per request | **PATCHED** | | httpd-0002 | Apache httpd | `modules/proxy/mod_proxy.c` — `set_proxy_exclude`/`set_proxy_dirconn` linear dedup scan per `NoProxy`/`ProxyDirectConnect` directive at config parse; O(N²); fix: `apr_hash_t` (249×) | **PATCHED** | | httpd-0003 | Apache httpd | `modules/ssl/ssl_engine_kernel.c:496` — `ssl_hook_Access_classic()` symmetric `sk_SSL_CIPHER_find()` O(N×M) per HTTPS request with per-directory `SSLCipherSuite`; fix: `HashSet` (12×) | **PATCHED** | | httpd-0004 | Apache httpd | `modules/proxy/mod_proxy_balancer.c:210` — `find_route_worker()` O(N²) recursive linear scan per failover redirect level; fix: route→worker hash map at init (50×) | **PATCHED** | | kicad-0001 | KiCad | `pcbnew/connectivity/from_to_cache.cpp:66` — `std::vector` linear scan in BFS visited-check; O(V²×B) per DRC from-to path | **PATCHED** | +| kicad-0002 | KiCad | `pcbnew/zone_filler.cpp:998` — `zonesToRefill std::find` O(Z²×L²) dedup in iterative island-refill triple nested loop; fix: `unordered_set` (300×) | **PATCHED** | | llvm-0003 | LLVM | `Transforms/Utils/LCSSA.cpp:70` — `SmallVectorImpl+is_contained()` in exit-block worklist; O(U×X) per loop | **PATCHED** | | spidermonkey-0001 | SpiderMonkey | `jit/IonAnalysis.cpp:~1997` — `Vector` linear scan in `LinearSum::add()`; O(N×T) Ion bounds-check elimination | **PATCHED** | | sm-0002 | SpiderMonkey | `js/src/jit/UnrollLoops.cpp:344` — `MDefinitionRemapper::lookup()` Vector linear scan O(V) called per operand per instruction during loop unrolling; O(V²) per body clone (150×) | **PATCHED** | @@ -881,7 +883,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^ 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency chains with depths in this range. -**601 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).** +**603 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).** --- diff --git a/whitepaper/undefect-cwe407-2026-03-27.pdf b/whitepaper/undefect-cwe407-2026-03-27.pdf index d53cf4815..95183134a 100644 Binary files a/whitepaper/undefect-cwe407-2026-03-27.pdf and b/whitepaper/undefect-cwe407-2026-03-27.pdf differ