dubbo-0001 + cxf-0001: annotation diamond recursion O(2^D); WSDL import O(N²); count 621→623

dubbo-0001: AnnotationUtils.getAllMetaAnnotations recurses into meta-annotation graph
without a visited set — diamond shapes cause O(2^D) calls (UNDF-2026-000000238)

cxf-0001: SchemaUtil.parseImports + WSDLServiceBuilder.parseImports use ArrayList.contains
as visited guard on WSDL import graph — O(N²) membership checks (UNDF-2026-000000237)

Struts, RabbitMQ, Camel: CLEAN

defects/struts/patch/CLEAN.md

@@ -0,0 +1,28 @@
+# Apache Struts — CWE-407 Scan Result: CLEAN
+
+## Scan Date: 2026-03-29
+
+## Method Scanned
+Searched `core/` for recursive traversal of interceptor/action dependency graphs without
+visited sets.
+
+## Findings
+
+### ActionChainResult — action chain cycle detection
+`ActionChainResult` uses a `LinkedList<String>` chain history stored in `ActionContext` as
+the cycle guard. The chain is appended on each hop; an `IllegalArgumentException` is thrown
+if the action name is already in the chain (infinite recursion guard). This is O(N) list
+membership per hop for N chain steps — acceptable for short action chains (typically 1-3
+deep in practice, bounded by configuration). Not a hot path in production traffic.
+
+### InterceptorBuilder.constructParameterizedInterceptorReferences
+The recursive call here resolves nested interceptor-stack parameter names. Recursion is
+driven by dotted-param keys (`stack1.interceptor1.param`) that are consumed at each level —
+no shared DAG is traversed. Termination is guaranteed by the param key prefix being stripped
+on each level. No visited guard needed; not CWE-407.
+
+### InterceptorStackConfig.getInterceptors
+Returns a pre-built flat `List<InterceptorMapping>` — no recursive graph traversal at runtime.
+
+## Conclusion
+CLEAN. No CWE-407 defects found in Apache Struts.