dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623

dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)

cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)

Struts, RabbitMQ, Camel: CLEAN

defects/rabbitmq/patch/CLEAN.md

@@ -0,0 +1,37 @@
+# RabbitMQ — CWE-407 Scan Result: CLEAN
+
+## Scan Date: 2026-03-29
+
+## Method Scanned
+Searched `deps/rabbit/src/rabbit_exchange.erl` and `deps/rabbit/src/rabbit_binding.erl` for
+recursive exchange routing graph traversal without a visited set.
+
+## Findings
+
+### rabbit_exchange.erl — route1/4 (lines 401-414)
+
+`route1` is a tail-recursive worklist BFS over the exchange routing graph. The third tuple
+element `SeenXs` tracks visited exchanges:
+
+```erlang
+route1(Message, Decorators, Opts,
+       {[X = #exchange{type = Type} | WorkList], SeenXs, QNames}) ->
+    ...
+    route1(Message, Decorators, Opts,
+           lists:foldl(fun process_route/2, {WorkList, SeenXs, QNames},
+                       AlternateDests ++ DecorateDests ++ ExchangeDests)).
+```
+
+`process_route` (line 437-443) checks `gb_sets:is_element(XName, SeenXs)` before adding a
+new exchange to the worklist. `gb_sets` is a balanced binary tree set — O(log N) membership
+test. Diamond exchange topology (A → B → D and A → C → D) is correctly handled; D is visited
+once.
+
+### rabbit_binding.erl
+
+No recursive traversal of binding graphs found. Binding operations work on flat lists from
+Mnesia queries — no graph DFS/BFS.
+
+## Conclusion
+CLEAN. RabbitMQ exchange routing uses `gb_sets` as a visited guard in `route1`. No CWE-407
+defects found.