dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623

dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)

cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)

Struts, RabbitMQ, Camel: CLEAN

defects/camel/patch/CLEAN.md

@@ -0,0 +1,32 @@
+# Apache Camel — CWE-407 Scan Result: CLEAN (beyond camel-0001)
+
+## Scan Date: 2026-03-29
+
+## Scope
+Searched for route dependency traversal, `@DependsOn`-style annotation handling, and
+recursive route startup ordering without visited sets. The pre-existing `camel-0001` defect
+(route startup `ArrayList` O(R²)) is already documented.
+
+## Findings
+
+### InternalRouteStartupManager
+Route startup ordering uses `TreeMap` and `LinkedHashMap` for ordering — no recursive
+traversal of a route dependency graph. Routes are sorted by `startupOrder` integer value
+via `Comparator`, not by graph traversal.
+
+### AbstractCamelContextFactoryBean.getDependsOn
+`getDependsOn()` is an abstract method returning a `String` — just a label for Spring
+`@DependsOn` ordering. No Camel-internal graph traversal is performed; Spring's own
+dependency resolution handles this.
+
+### Route dependency shutdown (DefaultShutdownStrategy)
+Uses reverse `startupOrder` sorting — no recursive graph traversal.
+
+### TypeUtils / annotation processors
+Camel does not use annotation processors for meta-annotation hierarchies in the manner
+Dubbo does. Camel's `@RoutingSlip`, `@RecipientList` etc. are resolved at runtime on
+flat lists.
+
+## Conclusion
+CLEAN (beyond pre-existing camel-0001). No additional CWE-407 defects found in Apache Camel
+route dependency or startup ordering code.