undf: assign 828-832; stamp patches; tomcat-0001/hibernate-orm-0001/netty-0001/netty-0002

2026-03-30 13:55:42 -04:00 · 2026-03-30 13:55:42 -04:00 · 9bdea940fc
commit 9bdea940fc
parent 32cbeb5dcb
36 changed files with 37 additions and 14 deletions
--- a/UNDF-REGISTRY.json
+++ b/UNDF-REGISTRY.json
@ -821,5 +821,14 @@
  "hive-0005": "UNDF-2026-000000820",
  "loki-0001": "UNDF-2026-000000821",
  "telegraf-0001": "UNDF-2026-000000822",
-  "ansible-0003": "UNDF-2026-000000823"
+  "ansible-0003": "UNDF-2026-000000823",
+  "bleach-0001": "UNDF-2026-000000824",
+  "go-0001": "UNDF-2026-000000825",
+  "go-0002": "UNDF-2026-000000826",
+  "hibernate-orm-0001": "UNDF-2026-000000827",
+  "hibernate-orm-0001-0001": "UNDF-2026-000000828",
+  "netty-0001-0001": "UNDF-2026-000000829",
+  "netty-0002-0002": "UNDF-2026-000000830",
+  "simplex-chat-0004": "UNDF-2026-000000831",
+  "tomcat-0001-0001": "UNDF-2026-000000832"
 }
--- a/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md
+++ b/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000234
+# UNDF: UNDF-2026-000000602
 # UNDF: (pending)
 # artemis-0002: FileConfigurationParser.parseSecurityRoles — O(N×R) multiple ArrayList.contains in role loop

--- a/defects/ansible/unit/AnsibleTest.class
+++ b/defects/ansible/unit/AnsibleTest.class
--- a/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md
+++ b/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000824
 # UNDF: (pending)
 # bleach-MOADX-0001: BleachSanitizerFilter.sanitize_css — ReDoS O(2^N) on style attribute

--- a/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md
+++ b/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000025
 # UNDF: (pending)
 # celery-MOADX-0001: BaseBackend.get_task_meta — stampede O(N) concurrent backend fetches on shared result cache

--- a/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md
+++ b/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000045
+# UNDF: UNDF-2026-000000605
 # UNDF: (pending)
 # composer-0003: InstalledRepository::getDependents — O(P²) in_array on growing needles list

--- a/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md
+++ b/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000379
 # UNDF: (pending)
 # django-0006: migrations.state.flatten_bases — O(2^D) diamond abstract model traversal

--- a/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md
+++ b/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000047
 # UNDF: (pending)
 # django-MOADX-0001: cached.Loader.get_template — stampede O(N) concurrent template compilations

--- a/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md
+++ b/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000002
+# UNDF: UNDF-2026-000000606
 # UNDF: (pending)
 # doctrine-orm-0001: ClassMetadata::addSubClass — O(N²) in_array on subClasses list

--- a/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md
+++ b/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000385
 # UNDF: (pending)
 # elasticsearch-MOADX-0001: EnrichCache.computeIfAbsent — cache stampede on enrich index search

--- a/defects/go/patch/go-0001.patch
+++ b/defects/go/patch/go-0001.patch
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000081
+# UNDF: UNDF-2026-000000825
 diff --git a/src/cmd/compile/internal/types2/infer.go b/src/cmd/compile/internal/types2/infer.go
 index eeefb117..cwe407fix 100644
 --- a/src/cmd/compile/internal/types2/infer.go
--- a/defects/go/patch/go-0002-expand1-diamond-recur-flag.md
+++ b/defects/go/patch/go-0002-expand1-diamond-recur-flag.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000562
+# UNDF: UNDF-2026-000000826
 # go-0002: cmd/compile/internal/typecheck expand1 O(2^D) diamond struct embedding

 ## CWE-407 — Algorithmic Complexity: O(2^D) Exponential Blowup on Diamond-Shaped Struct Embeddings
--- a/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md
+++ b/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000081
+# UNDF: UNDF-2026-000000825
 # go-stdlib-0001 — net/http/internal/http2: rfc9218Priority allocates []string per header field

 **Severity:** MEDIUM
--- a/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md
+++ b/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000096
 # UNDF: (pending)
 # hadoop-MOADX-0001: FederationJCache/FederationCaffeineCache — cache stampede on YARN Federation state store

--- a/defects/helm/patch/helm-0001-resourcelist-contains-map.md
+++ b/defects/helm/patch/helm-0001-resourcelist-contains-map.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000232
+# UNDF: UNDF-2026-000000104
 # UNDF: (pending)
 # helm-0001: ResourceList.Contains/Difference/Intersect — O(N²) linear scan

--- a/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch
+++ b/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000828
 # UNDF:
 # Defect: hibernate-orm-0001
 # Component: org.hibernate.boot.internal.InFlightMetadataCollectorImpl
--- a/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class
+++ b/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class
--- a/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class
+++ b/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class
--- a/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md
+++ b/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000827
 # UNDF: (pending)
 # hibernate-orm-MOADX-0001: QueryInterpretationCacheStandardImpl — cache stampede O(N) concurrent plan builds on cold start

--- a/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md
+++ b/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000015
+# UNDF: UNDF-2026-000000609
 # UNDF: (pending)
 # mastodon-0001: OStatus::Activity::Creation#save_mentions — O(N²) processed_account_ids Array#include? dedup

--- a/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md
+++ b/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000016
+# UNDF: UNDF-2026-000000610
 # UNDF: (pending)
 # mastodon-0002: ActivityPub::Activity::Create#process_hashtag — O(N²) status.tags.include? AR query per tag in loop

--- a/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch
+++ b/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000829
 # UNDF:
 # Defect: netty-0001
 # Component: io.netty.handler.ssl.JdkBaseApplicationProtocolNegotiator
--- a/defects/netty-0001/test/Netty0001Test.class
+++ b/defects/netty-0001/test/Netty0001Test.class
--- a/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch
+++ b/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000830
 # UNDF:
 # Defect: netty-0002
 # Component: io.netty.resolver.dns.DnsResolveContext
--- a/defects/netty-0002/test/Netty0002Test.class
+++ b/defects/netty-0002/test/Netty0002Test.class
--- a/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md
+++ b/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000054
+# UNDF: UNDF-2026-000000612
 # UNDF: (pending)
 # sea-orm-0001: enumerate_role / list_role_hierarchy_edges — O(2^D) diamond BFS

--- a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md
+++ b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000831
 # Defect: simplex-chat-0004 — introduceToRemaining `notElem` O(N×M) member dedup

 **Project:** simplex-chat  
--- a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch
+++ b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000831
 # UNDF: (pending)
 --- a/src/Simplex/Chat/Library/Internal.hs
 +++ b/src/Simplex/Chat/Library/Internal.hs
--- a/defects/solang/patch/solang-0001-emits-events-vec-hashset.md
+++ b/defects/solang/patch/solang-0001-emits-events-vec-hashset.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000055
+# UNDF: UNDF-2026-000000613
 # UNDF: (pending)
 # solang-0001: add_external_functions emits_events Vec::contains O(F×E²) → O(F×E)

--- a/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md
+++ b/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000317
+# UNDF: UNDF-2026-000000614
 # UNDF: (pending)
 # spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation — O(B×M) ArrayList.contains inside loop

--- a/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md
+++ b/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000295
 # UNDF: (pending)
 # spring-MOADX-0001: AbstractFallbackCacheOperationSource — cache stampede O(N) concurrent annotation scans on cold start

--- a/defects/terraform/unit/TerraformTest$Graph.class
+++ b/defects/terraform/unit/TerraformTest$Graph.class
--- a/defects/terraform/unit/TerraformTest.class
+++ b/defects/terraform/unit/TerraformTest.class
--- a/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch
+++ b/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch
@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000832
 # UNDF:
 # Defect: tomcat-0001
 # Component: org.apache.tomcat.websocket.server.DefaultServerEndpointConfigurator
--- a/defects/tomcat-0001/test/Tomcat0001Test.class
+++ b/defects/tomcat-0001/test/Tomcat0001Test.class
--- a/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md
+++ b/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md
@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000233
+# UNDF: UNDF-2026-000000615
 # UNDF: (pending)
 # vertx-core-0001: HAManager.nodeLeft — O(N×M) nodes List.contains inside clusterMap loop