diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index b7c521d3a..8c6fa76cb 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -821,5 +821,14 @@ "hive-0005": "UNDF-2026-000000820", "loki-0001": "UNDF-2026-000000821", "telegraf-0001": "UNDF-2026-000000822", - "ansible-0003": "UNDF-2026-000000823" + "ansible-0003": "UNDF-2026-000000823", + "bleach-0001": "UNDF-2026-000000824", + "go-0001": "UNDF-2026-000000825", + "go-0002": "UNDF-2026-000000826", + "hibernate-orm-0001": "UNDF-2026-000000827", + "hibernate-orm-0001-0001": "UNDF-2026-000000828", + "netty-0001-0001": "UNDF-2026-000000829", + "netty-0002-0002": "UNDF-2026-000000830", + "simplex-chat-0004": "UNDF-2026-000000831", + "tomcat-0001-0001": "UNDF-2026-000000832" } diff --git a/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md b/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md index e90dfc270..e1cc38408 100644 --- a/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md +++ b/defects/activemq-artemis/patch/artemis-0002-fileconfigparser-allroles-list-contains.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000234 +# UNDF: UNDF-2026-000000602 # UNDF: (pending) # artemis-0002: FileConfigurationParser.parseSecurityRoles — O(N×R) multiple ArrayList.contains in role loop diff --git a/defects/ansible/unit/AnsibleTest.class b/defects/ansible/unit/AnsibleTest.class new file mode 100644 index 000000000..25140ab46 Binary files /dev/null and b/defects/ansible/unit/AnsibleTest.class differ diff --git a/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md b/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md index 7f8d3a94b..fab54f4c6 100644 --- a/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md +++ b/defects/bleach/patch/bleach-MOADX-0001-sanitize-css-gauntlet-redos.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000824 # UNDF: (pending) # bleach-MOADX-0001: BleachSanitizerFilter.sanitize_css — ReDoS O(2^N) on style attribute diff --git a/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md b/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md index 0b78931bc..7f3fe72db 100644 --- a/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md +++ b/defects/celery/patch/celery-MOADX-0001-get-task-meta-cache-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000025 # UNDF: (pending) # celery-MOADX-0001: BaseBackend.get_task_meta — stampede O(N) concurrent backend fetches on shared result cache diff --git a/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md b/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md index 215cdac14..b53690e73 100644 --- a/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md +++ b/defects/composer/patch/composer-0003-installed-repo-needles-inarray.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000045 +# UNDF: UNDF-2026-000000605 # UNDF: (pending) # composer-0003: InstalledRepository::getDependents — O(P²) in_array on growing needles list diff --git a/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md b/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md index ceebbec4b..efe770d46 100644 --- a/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md +++ b/defects/django/patch/django-0006-migrations-flatten-bases-diamond.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000379 # UNDF: (pending) # django-0006: migrations.state.flatten_bases — O(2^D) diamond abstract model traversal diff --git a/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md b/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md index 207250d32..0b2b436c0 100644 --- a/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md +++ b/defects/django/patch/django-MOADX-0001-cached-loader-template-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000047 # UNDF: (pending) # django-MOADX-0001: cached.Loader.get_template — stampede O(N) concurrent template compilations diff --git a/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md b/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md index 346300159..533e3f502 100644 --- a/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md +++ b/defects/doctrine-orm/patch/doctrine-orm-0001-subclasses-list-inarray.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000002 +# UNDF: UNDF-2026-000000606 # UNDF: (pending) # doctrine-orm-0001: ClassMetadata::addSubClass — O(N²) in_array on subClasses list diff --git a/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md b/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md index 343352040..a8b2308eb 100644 --- a/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md +++ b/defects/elasticsearch/patch/elasticsearch-MOADX-0001-enrich-cache-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000385 # UNDF: (pending) # elasticsearch-MOADX-0001: EnrichCache.computeIfAbsent — cache stampede on enrich index search diff --git a/defects/go/patch/go-0001.patch b/defects/go/patch/go-0001.patch index b23327bd6..fe325cdaa 100644 --- a/defects/go/patch/go-0001.patch +++ b/defects/go/patch/go-0001.patch @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000081 +# UNDF: UNDF-2026-000000825 diff --git a/src/cmd/compile/internal/types2/infer.go b/src/cmd/compile/internal/types2/infer.go index eeefb117..cwe407fix 100644 --- a/src/cmd/compile/internal/types2/infer.go diff --git a/defects/go/patch/go-0002-expand1-diamond-recur-flag.md b/defects/go/patch/go-0002-expand1-diamond-recur-flag.md index b756d9f38..fe4b805f2 100644 --- a/defects/go/patch/go-0002-expand1-diamond-recur-flag.md +++ b/defects/go/patch/go-0002-expand1-diamond-recur-flag.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000562 +# UNDF: UNDF-2026-000000826 # go-0002: cmd/compile/internal/typecheck expand1 O(2^D) diamond struct embedding ## CWE-407 — Algorithmic Complexity: O(2^D) Exponential Blowup on Diamond-Shaped Struct Embeddings diff --git a/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md b/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md index e4a0ac286..9d3505dd7 100644 --- a/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md +++ b/defects/go/patch/go-stdlib-0001-http2-rfc9218priority-header-alloc.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000081 +# UNDF: UNDF-2026-000000825 # go-stdlib-0001 — net/http/internal/http2: rfc9218Priority allocates []string per header field **Severity:** MEDIUM diff --git a/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md b/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md index c57b0b7be..08d721813 100644 --- a/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md +++ b/defects/hadoop/patch/hadoop-MOADX-0001-federation-cache-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000096 # UNDF: (pending) # hadoop-MOADX-0001: FederationJCache/FederationCaffeineCache — cache stampede on YARN Federation state store diff --git a/defects/helm/patch/helm-0001-resourcelist-contains-map.md b/defects/helm/patch/helm-0001-resourcelist-contains-map.md index 30c0bb4f3..dd0cc73f0 100644 --- a/defects/helm/patch/helm-0001-resourcelist-contains-map.md +++ b/defects/helm/patch/helm-0001-resourcelist-contains-map.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000232 +# UNDF: UNDF-2026-000000104 # UNDF: (pending) # helm-0001: ResourceList.Contains/Difference/Intersect — O(N²) linear scan diff --git a/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch b/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch index 075bfe640..d2cec8f9f 100644 --- a/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch +++ b/defects/hibernate-orm-0001/patch/hibernate-orm-0001-fk-secondpass-list-contains.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000828 # UNDF: # Defect: hibernate-orm-0001 # Component: org.hibernate.boot.internal.InFlightMetadataCollectorImpl diff --git a/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class b/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class new file mode 100644 index 000000000..cbf02bf88 Binary files /dev/null and b/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class differ diff --git a/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class b/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class new file mode 100644 index 000000000..38620d913 Binary files /dev/null and b/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class differ diff --git a/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md b/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md index 16dd742b2..7e5190dd7 100644 --- a/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md +++ b/defects/hibernate-orm/patch/hibernate-orm-MOADX-0001-query-interpretation-cache-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000827 # UNDF: (pending) # hibernate-orm-MOADX-0001: QueryInterpretationCacheStandardImpl — cache stampede O(N) concurrent plan builds on cold start diff --git a/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md b/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md index bd0baee8f..773ba43f3 100644 --- a/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md +++ b/defects/mastodon/patch/mastodon-0001-ostatus-creation-processed-account-ids-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000015 +# UNDF: UNDF-2026-000000609 # UNDF: (pending) # mastodon-0001: OStatus::Activity::Creation#save_mentions — O(N²) processed_account_ids Array#include? dedup diff --git a/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md b/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md index fa1f2a253..151b8407a 100644 --- a/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md +++ b/defects/mastodon/patch/mastodon-0002-activitypub-create-process-hashtag-tags-include.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000016 +# UNDF: UNDF-2026-000000610 # UNDF: (pending) # mastodon-0002: ActivityPub::Activity::Create#process_hashtag — O(N²) status.tags.include? AR query per tag in loop diff --git a/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch b/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch index e89e21754..21197beef 100644 --- a/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch +++ b/defects/netty-0001/patch/netty-0001-alpn-list-contains.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000829 # UNDF: # Defect: netty-0001 # Component: io.netty.handler.ssl.JdkBaseApplicationProtocolNegotiator diff --git a/defects/netty-0001/test/Netty0001Test.class b/defects/netty-0001/test/Netty0001Test.class new file mode 100644 index 000000000..48cf2d867 Binary files /dev/null and b/defects/netty-0001/test/Netty0001Test.class differ diff --git a/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch b/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch index bcdde8a7f..6bd03472c 100644 --- a/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch +++ b/defects/netty-0002/patch/netty-0002-dns-resolve-dedup-list-contains.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000830 # UNDF: # Defect: netty-0002 # Component: io.netty.resolver.dns.DnsResolveContext diff --git a/defects/netty-0002/test/Netty0002Test.class b/defects/netty-0002/test/Netty0002Test.class new file mode 100644 index 000000000..6428e0f09 Binary files /dev/null and b/defects/netty-0002/test/Netty0002Test.class differ diff --git a/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md b/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md index ac26efa88..5f25cbeb8 100644 --- a/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md +++ b/defects/sea-orm/patch/sea-orm-0001-rbac-role-hierarchy-diamond-bfs.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000054 +# UNDF: UNDF-2026-000000612 # UNDF: (pending) # sea-orm-0001: enumerate_role / list_role_hierarchy_edges — O(2^D) diamond BFS diff --git a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md index 42f2b3e47..06549ab95 100644 --- a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md +++ b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000831 # Defect: simplex-chat-0004 — introduceToRemaining `notElem` O(N×M) member dedup **Project:** simplex-chat diff --git a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch index fc6eedff5..ad9839ce3 100644 --- a/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch +++ b/defects/simplex-chat/patch/simplex-chat-0004-introduce-to-remaining-notelem.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000831 # UNDF: (pending) --- a/src/Simplex/Chat/Library/Internal.hs +++ b/src/Simplex/Chat/Library/Internal.hs diff --git a/defects/solang/patch/solang-0001-emits-events-vec-hashset.md b/defects/solang/patch/solang-0001-emits-events-vec-hashset.md index 7633baa5a..6ad437cf1 100644 --- a/defects/solang/patch/solang-0001-emits-events-vec-hashset.md +++ b/defects/solang/patch/solang-0001-emits-events-vec-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000055 +# UNDF: UNDF-2026-000000613 # UNDF: (pending) # solang-0001: add_external_functions emits_events Vec::contains O(F×E²) → O(F×E) diff --git a/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md b/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md index 71a6f8936..b959add4e 100644 --- a/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md +++ b/defects/spring/patch/spring-0002-defaultlistablebeanfactory-getnamesforannotation-list-contains.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000317 +# UNDF: UNDF-2026-000000614 # UNDF: (pending) # spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation — O(B×M) ArrayList.contains inside loop diff --git a/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md b/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md index 9b0c2f883..b4105ccdc 100644 --- a/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md +++ b/defects/spring/patch/spring-MOADX-0001-fallback-cache-operation-source-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000295 # UNDF: (pending) # spring-MOADX-0001: AbstractFallbackCacheOperationSource — cache stampede O(N) concurrent annotation scans on cold start diff --git a/defects/terraform/unit/TerraformTest$Graph.class b/defects/terraform/unit/TerraformTest$Graph.class new file mode 100644 index 000000000..98271549e Binary files /dev/null and b/defects/terraform/unit/TerraformTest$Graph.class differ diff --git a/defects/terraform/unit/TerraformTest.class b/defects/terraform/unit/TerraformTest.class new file mode 100644 index 000000000..3d59afc01 Binary files /dev/null and b/defects/terraform/unit/TerraformTest.class differ diff --git a/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch b/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch index cdfa41c40..01fe3aaf1 100644 --- a/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch +++ b/defects/tomcat-0001/patch/tomcat-0001-websocket-subprotocol-list-contains.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000832 # UNDF: # Defect: tomcat-0001 # Component: org.apache.tomcat.websocket.server.DefaultServerEndpointConfigurator diff --git a/defects/tomcat-0001/test/Tomcat0001Test.class b/defects/tomcat-0001/test/Tomcat0001Test.class new file mode 100644 index 000000000..15d85ebc0 Binary files /dev/null and b/defects/tomcat-0001/test/Tomcat0001Test.class differ diff --git a/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md b/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md index 6da52e607..a8aa602f6 100644 --- a/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md +++ b/defects/vertx-core/patch/vertx-core-0001-hamanager-nodeleft-nodes-list-contains.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000233 +# UNDF: UNDF-2026-000000615 # UNDF: (pending) # vertx-core-0001: HAManager.nodeLeft — O(N×M) nodes List.contains inside clusterMap loop